A critical security flaw in Meta’s customer support infrastructure has been identified, exposing sensitive user data such as emails, chat transcripts, and uploaded files. This vulnerability, discovered during security assessments of Meta Horizon Managed Solutions, revealed a broader authorization weakness affecting multiple support services within Meta’s ecosystem.
The issue originated from inconsistent enforcement of authorization checks in Meta’s backend systems. Security researcher Rony K Roy found that several GraphQL operations returned sensitive support data even when the requesting user lacked the necessary permissions. This oversight allowed unauthorized access to support cases, internal notes, escalation details, and attachments linked to other users’ support requests.
The exposed data encompassed customer support emails exchanged with Meta, chat transcripts with support agents, case metadata, and files uploaded during support interactions. In many instances, this information contained personally identifiable information, such as names, email addresses, phone numbers, and other contact details voluntarily shared by users during support engagements.
Further analysis revealed that support case identifiers were assigned sequentially. Combined with the authorization flaw, this enabled attackers to enumerate case IDs and retrieve large volumes of sensitive support records without proper access rights, significantly amplifying the potential impact of the vulnerability.
In addition to unauthorized data access, the flaw permitted certain actions to be performed without proper permissions. These actions included creating support requests on behalf of other organizations, modifying support case statuses, and adding external users as subscribers to existing cases. Such capabilities could have allowed attackers to manipulate support workflows or gain visibility into ongoing support interactions.
The affected infrastructure appeared to rely partially on Salesforce-backed systems; however, the vulnerability was not directly related to Salesforce itself. Instead, it stemmed from flaws in how Meta implemented and integrated authorization controls across shared services. The issue aligns with common security classifications, including Broken Access Control (CWE-284), Insecure Direct Object Reference (CWE-639), and Missing Authorization (CWE-862).
According to Rony K Roy, the vulnerability was reported in January 2026, upgraded to critical after its broader impact was discovered, and fully remediated by April, with no evidence of active exploitation.
This incident underscores the risks associated with shared backend architectures, where inconsistent authorization logic can affect multiple services. It also highlights the importance of enforcing strict access controls and validating permissions at every layer of application workflows, especially in systems handling sensitive customer communications.
