Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data

Meta paid a $78,000 bounty after a security researcher found a broken access control vulnerability in Meta’s support infrastructure that could expose customer support data. SecurityWeek reported the finding as a bug-bounty payout for access-control failure in the systems that handle support workflows, not a vague “data leak” claim with no product surface named.

Broken access control means the support stack failed to enforce who could read which support records—typically missing or incorrect authorization checks on support APIs, admin or agent tools, or ticket-related endpoints so that a principal without the right role could still retrieve customer support data. In support infrastructure that often sits beside identity, messaging, and case-management systems, that class of flaw is about authorization on data access paths, not about cracking encryption or guessing credentials.

For engineers and builders, the incident is a reminder that support and helpdesk systems are high-value targets: they concentrate account history, contact details, and case content, and they are often built with internal tools, third-party widgets, and privileged agent roles. Shipping “support only” surfaces without the same authorization tests used on core product APIs leaves a wide path to sensitive data even when the main app looks locked down.

In the broader market, large platforms pay substantial bounties for access-control bugs precisely because support and admin planes are hard to audit and easy to under-protect relative to consumer-facing features. A $78,000 Meta payout signals that vendors treat support-data exposure as severe, and that independent research remains a primary way these failures get found when internal review misses them.

Practical takeaway: treat support infrastructure as production security surface—map every path that returns ticket or customer support data, require explicit authorization on every read, and regression-test role boundaries the same way you test login. What to watch next is whether Meta’s disclosure trail or bounty write-ups spell out the exact control that failed and how support authorization was hardened after the report.