Meta paid a $78,000 bug bounty to independent researcher Rony K Roy after he uncovered a broken access control vulnerability that exposed customer support data across multiple support channels.

 

What happened

Roy discovered and reported the vulnerability to Meta in January 2026. His initial report described a security hole of limited severity, but further investigation revealed additional impacts affecting multiple support channels, increasing the overall severity of the finding. Meta completed remediation across the affected systems in April 2026 and confirmed it found no evidence that the vulnerability had been abused. Roy publicly disclosed his findings last week and told SecurityWeek he received the $78,000 bounty.

 

Going deeper

Roy's research began while he was investigating Meta Horizon Managed Solutions, an enterprise platform that lets organizations manage Meta Quest devices and users. During testing, he found that several support-related GraphQL operations returned information even when the requesting user lacked the permissions normally needed for support functionality, showing that authorization decisions weren't being enforced consistently across support workflows. As he dug further, he found that multiple, separate support channels actually relied on the same backend services and shared authorization assumptions, meaning a weakness in one product ended up affecting several others built on the same infrastructure. He also noted that parts of the support system relied on Salesforce-backed workflows and data models. The vulnerability wasn't in Salesforce itself, but in how Meta implemented and integrated those systems.

The exposure covered Meta.com support email conversations between customers and Meta Support, support cases and their metadata, customer support chat conversations, internal case summaries and escalation notes, attachments submitted with support requests, and contact information customers shared during support interactions. Beyond viewing data, an attacker could have created support requests on behalf of other Meta Horizon Managed Solutions organizations, changed support case states, and added external users as unauthorized subscribers to support cases.

 

What was said

Roy has said Meta stated it found no evidence that the vulnerability was abused. In his write-up, he noted that certain technical details, proof-of-concept materials, and other potential impacts were deliberately left out of his public disclosure, since some observations haven't been confirmed or denied by Meta and he wanted to avoid giving anyone a way to reproduce the issue.

 

Why it matters

This wasn't a single leaky endpoint, it was a shared-infrastructure problem because multiple, unrelated support products relied on the same backend authorization logic, one gap in enforcement rippled across several channels at once, letting an attacker potentially read private conversations, pull attachments and contact details, and also reach into the workflow itself to fabricate requests, change case statuses, or add unauthorized subscribers. That combination is what pushes this from a privacy concern into something closer to a way of quietly hijacking an organization's support relationship with Meta. It also matters for healthcare specifically because Meta Horizon Managed Solutions is built for enterprises managing fleets of Quest devices, and healthcare organizations use VR platforms like this for clinical training, surgical simulation, and therapy programs. Support tickets tied to those deployments can carry sensitive operational details, so a flaw letting outsiders read, redirect, or tamper with those cases is exposure risk for any hospital or health system running Quest-based tools, even though this particular incident wasn't healthcare-specific.

 

The bottom line

Meta patched the issue in April with no signs it was exploited, but the case shows how a small authorization bug can widen once shared backend infrastructure is involved. Organizations relying on enterprise support platforms should watch for unusual activity on support cases and verify any changes to case status or subscribers rather than assuming they're legitimate.

 

FAQs

What is broken access control?

It's a security flaw where a system fails to properly verify whether a user is authorized to access the data or actions they're requesting.

 

What is an IDOR vulnerability?

It's a flaw where an application exposes internal identifiers, like sequential case or record numbers, letting attackers guess or enumerate other users' data.

 

How do bug bounty programs work?

Companies invite researchers to find and report security flaws in exchange for a monetary reward based on the severity and impact of the issue.

 

Why do bug bounty payouts vary?

Rewards are generally tied to how much data or system control the flaw could expose and how easily it could be exploited.