Meta Fixes Critical IDOR Flaw Exposing Customer Support Data Across Services

Meta has remediated a critical security vulnerability involving broken access control that exposed sensitive customer support information across multiple services within its ecosystem.

The flaw, which affected shared backend infrastructure supporting Meta’s customer support workflows, allowed unauthorized users to access confidential support records, live chat transcripts, internal case notes, and personally identifiable information (PII) without proper authorization.

Security researchers classified the issue as a combination of Insecure Direct Object Reference (IDOR) (CWE-639), Broken Access Control (CWE-284), and Missing Authorization (CWE-862), highlighting a significant weakness in the way authorization policies were enforced across interconnected services.

Meta Fixes Critical IDOR Flaw

Although Meta confirmed there is no evidence that the vulnerability was exploited in the wild, the incident underscores the growing security challenges associated with large-scale cloud platforms and shared microservices architectures.

The vulnerability originated from inconsistent authorization validation across Meta’s customer support backend. Under specific conditions, attackers could submit crafted requests that bypassed access control mechanisms and retrieve support-related information belonging to other users or organizations.

Because the affected services relied on common backend infrastructure, the flaw extended beyond a single application, impacting multiple customer support channels hosted on Meta.com and related enterprise platforms.

The exposure significantly increased the potential impact, as attackers could access confidential communications intended only for authorized support personnel and verified customers.

Researchers discovered that the vulnerability exposed a broad range of sensitive support information. Unauthorized users were able to retrieve customer support emails, support ticket histories, case summaries, live chat conversations, escalation records, internal troubleshooting notes, attachments, and various metadata associated with ongoing support cases.

Much of this information contained personally identifiable information, including customer names, email addresses, phone numbers, and operational details submitted during technical support requests.

Such information could provide cybercriminals with valuable intelligence for phishing campaigns, identity theft, business email compromise (BEC), or targeted social engineering attacks against affected organizations.

Beyond passive data exposure, the vulnerability also enabled active manipulation of customer support workflows. Attackers could create support cases on behalf of other organizations, modify existing ticket statuses, and subscribe unauthorized users to confidential support conversations.

These capabilities could have been exploited to disrupt legitimate support operations, inject misleading information into ongoing investigations, or gain continued visibility into sensitive enterprise communications.

In corporate environments, unauthorized modifications to support cases could interfere with incident response activities and delay resolution of legitimate technical issues.

The flaw was initially identified during security testing of Meta Horizon Managed Solutions, an enterprise platform used to manage Meta Quest devices, applications, and organizational users.

Researchers observed that certain GraphQL API queries returned support-related records even when the requesting account lacked sufficient permissions.

This inconsistent enforcement of authorization controls indicated that backend services trusted incoming requests without performing proper ownership validation. Further investigation revealed that multiple customer support systems shared common backend components that relied on flawed trust assumptions across internal services.

Security researchers also discovered that the vulnerability was amplified by the use of sequential support case identifiers.

Since case IDs followed predictable numerical patterns, attackers could systematically enumerate support records by modifying request parameters.

Without robust authorization checks verifying ownership of each case, the predictable identifiers made it possible to access large volumes of sensitive customer information with relatively simple automated requests.

This combination of predictable object identifiers and missing authorization validation represents one of the most common causes of modern IDOR vulnerabilities affecting API-driven applications.

The investigation further revealed that portions of Meta’s support infrastructure integrated with Salesforce-backed components.

While Salesforce itself was not vulnerable, Meta’s implementation failed to consistently enforce authorization policies across integrated systems.

As customer support requests moved between internal services and third-party platforms, inconsistent validation created multiple opportunities for unauthorized access.

This illustrates the security risks that emerge when complex cloud ecosystems rely on shared services without centralized access control enforcement.

The vulnerability was responsibly disclosed to Meta in January 2026, with researchers identifying additional affected services during the investigation.

As the scope expanded, the severity of the issue increased due to its cross-platform impact. Meta completed remediation in April 2026, implementing comprehensive authorization checks across affected APIs, GraphQL endpoints, and customer support workflows.

The company confirmed that internal investigations found no evidence of active exploitation before the security fixes were deployed.

This incident serves as an important reminder that broken access control remains one of the most dangerous security weaknesses in modern applications.

As organizations increasingly adopt cloud-native architectures, APIs, and shared microservices, maintaining consistent authorization enforcement across every component becomes essential.

Security experts recommend implementing centralized access control mechanisms, validating object ownership on every request, avoiding predictable identifiers where possible, performing continuous API security assessments, and monitoring backend services for abnormal access patterns.

By strengthening authorization validation throughout interconnected systems, organizations can significantly reduce the risk of sensitive data exposure caused by IDOR and broken access control vulnerabilities.