Meta Security Flaw Exposed Sensitive User Data

A significant vulnerability in Meta’s customer support systems was recently uncovered, revealing that private user data such as emails, chat logs, and files were accessible due to a broken access control. This flaw was identified during a security assessment of Meta Horizon Managed Solutions, uncovering a larger authorization issue across various Meta support services.

Extent of the Vulnerability

What initially appeared as a minor, isolated issue soon emerged as a broader cross-platform security risk. It was found to affect Meta.com support systems, customer support chats, and internal case management workflows. At the heart of the problem was the inconsistent application of authorization checks within Meta’s backend infrastructure.

Security researcher Rony K Roy discovered that certain GraphQL operations were improperly allowing access to sensitive support data, even when users did not possess adequate permissions. This oversight enabled unauthorized access to support cases, internal comments, escalation details, and attachments pertaining to other users’ support requests.

Impact on User Data

The breach exposed a wide array of sensitive information, including emails exchanged with Meta customer support, chat transcripts with agents, case metadata, and files shared during support interactions. This data often contained personally identifiable information, such as names, email addresses, and phone numbers, willingly provided by users during these exchanges.

An in-depth analysis by Rony K Roy revealed that support case identifiers were assigned sequentially. Coupled with the authorization flaw, attackers could exploit this to enumerate case IDs and extract vast amounts of sensitive support records without adequate access rights, greatly amplifying the vulnerability’s potential impact.

Systemic Flaws and Resolution

Beyond unauthorized data access, the flaw allowed specific actions to be performed without proper permissions, such as initiating support requests for other organizations, altering support case statuses, and adding external users to existing cases. These capabilities could have been used by attackers to manipulate support workflows or gain insight into ongoing interactions.

While the affected infrastructure partly relied on Salesforce systems, the vulnerability originated from Meta’s integration and implementation of authorization controls across its shared services. The issue is categorized under common security vulnerabilities such as Broken Access Control, Insecure Direct Object Reference, and Missing Authorization.

According to Rony K Roy, the vulnerability was reported in January 2026, upgraded to critical once its broader impact was understood, and was fully addressed by April. Fortunately, there is no evidence of the flaw being actively exploited. This incident highlights the dangers of shared backend architectures where inconsistent authorization logic can compromise multiple services.

It underscores the necessity of enforcing robust access controls and validating permissions at every workflow layer, especially in systems dealing with sensitive customer communications.