Critical Meta Vulnerability Exposed Customer Support Data

Key Takeaways

• A critical broken access control vulnerability in Meta’s shared customer support systems exposed sensitive user data.
• The flaw affected Meta.com support, customer chat, and internal case management, allowing unauthorized access to emails, chat logs, and uploaded files.
• Discovered by Rony K Roy, the issue stemmed from inconsistent authorization checks in Meta’s backend infrastructure, not Salesforce directly.
• Meta remediated the vulnerability by April 2026, after it was reported in January 2026 and escalated to critical severity.

Meta Customer Support Systems Vulnerability Exposed Sensitive Data

A significant broken access control flaw within Meta’s shared customer support infrastructure led to the exposure of highly sensitive user data, including private emails, chat conversations, and uploaded files. The vulnerability, initially identified during routine security assessments of Meta Horizon Managed Solutions, quickly revealed a widespread authorization weakness affecting various support services across Meta’s ecosystem.

What first appeared to be a product-specific defect soon escalated into a pervasive security risk impacting Meta.com support systems, customer support chat functionalities, and internal case management workflows. The core of the vulnerability resided in Meta’s backend infrastructure, specifically in the inconsistent enforcement of authorization checks.

Technical Breakdown of the Flaw

Researchers, including Rony K Roy, discovered that several GraphQL operations were configured to return sensitive support data even when the requesting user lacked the necessary permissions. This critical oversight enabled unauthorized individuals to access confidential support cases, internal notes, escalation details, and attachments associated with other users’ support requests.

The exposed information encompassed customer support emails exchanged with Meta, transcripts of chats with support agents, extensive case metadata, and various files users had uploaded during their support interactions. Much of this data contained personally identifiable information (PII), such as names, email addresses, phone numbers, and other contact details voluntarily provided by users when engaging with support.

According to a Rony K Roy post, further analysis revealed that support case identifiers were assigned sequentially. This sequential assignment, coupled with the authorization flaw, presented an attacker with the ability to enumerate case IDs and retrieve a substantial volume of sensitive support records without proper access rights, significantly amplifying the potential impact of the vulnerability.

Beyond unauthorized data access, the flaw also permitted certain actions to be executed without appropriate permissions. These actions included the ability to create support requests on behalf of other organizations, modify the status of existing support cases, and add external users as subscribers to ongoing cases. Such capabilities could have allowed malicious actors to manipulate support workflows or gain visibility into active support interactions covertly.

While the affected infrastructure appeared to leverage Salesforce-backed systems in part, the vulnerability was not a direct flaw in Salesforce itself. Instead, it originated from Meta’s implementation and integration of authorization controls across its shared services. The issue aligns with well-known security classifications such, as Broken Access Control (CWE-284), Insecure Direct Object Reference (CWE-639), and Missing Authorization (CWE-862).

The vulnerability was initially reported in January 2026, escalated to critical status upon discovery of its broader implications, and fully remediated by April 2026. Meta confirmed no evidence of active exploitation, as detailed in the researcher’s post. This incident underscores the inherent risks associated with shared backend architectures, where inconsistent authorization logic can inadvertently impact multiple services and highlights the critical need for rigorous access control enforcement and permission validation at every layer of application workflows, especially in systems handling sensitive customer communications.

What You Should Do

• For Organizations: Regularly audit and review access control mechanisms across all integrated systems, especially those handling sensitive customer data or supporting multiple applications. Implement robust authorization checks at every API endpoint and workflow step.
• For Users: While the vulnerability has been patched, always be cautious about the personal information shared during support interactions. Only provide necessary details and be mindful of phishing attempts that might leverage information from past support cases.
• For Developers: Prioritize consistent authorization logic across all microservices and shared components. Adopt a “deny by default” principle and explicitly grant permissions. Implement strict input validation and avoid sequential ID assignment for sensitive resources.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.