Meta has awarded a substantial bug bounty to a security researcher who identified a critical vulnerability exposing customer support data. This significant discovery highlights ongoing concerns in data security and privacy management.
Discovery of the Vulnerability
In January 2026, independent researcher Rony K Roy detected a security flaw in Meta’s systems, initially classified as having limited severity. However, deeper investigation revealed its potential impact was much more substantial than first believed. The vulnerability’s nature necessitated prompt action from Meta, which addressed the issue with patches by April.
Roy’s analysis uncovered serious issues within Meta’s backend support infrastructure, specifically tied to missing authorization, broken access control, and insecure direct object reference (IDOR) vulnerabilities. The combination of these flaws could have been exploited to access sensitive information.
Potential Risks and Exploitation
If exploited, the vulnerability could have allowed unauthorized access to email and chat conversations between users and Meta’s support team, as well as support case details and files shared during these interactions. Additionally, personal and contact information disclosed to Meta support could have been compromised.
Beyond data access, attackers could have manipulated support processes, creating and modifying support requests on behalf of organizations using Meta Horizon Managed Solutions. This included the ability to alter case statuses and add unauthorized participants to support cases.
Roy’s Recognition and Broader Implications
For his discovery, Roy received a $78,000 reward from Meta, reflecting the gravity of the vulnerability. While Meta has not publicly confirmed these details, Roy is acknowledged on Meta’s bug bounty leaderboard for 2026. This incident underscores the importance of robust security measures and the critical role of independent researchers in identifying vulnerabilities.
As companies continue to rely on vast data networks, ensuring the security and privacy of customer information remains paramount. This case serves as a reminder of the constant vigilance required to protect sensitive data from potential breaches.
Related security issues, such as the recent ServiceNow vulnerability exploitation and updates to Zimbra and OpenSSL, highlight the dynamic and evolving nature of cybersecurity threats and the necessity for ongoing updates and patches to safeguard information.
