Facebook awards $30000 bounty for exploit exposing private Instagram content

Facebook has awarded $30,000 to a researcher for reporting vulnerabilities in Instagram’s privacy features.
According to a Medium blog post penned by bug bounty hunter Mayur Fartade on Tuesday, a set of vulnerable endpoints in the Instagram app could have allowed attackers to view private media on the platform without following a target account.
This included private and archived posts, stories, and reels.
If an attacker obtains a target user’s Media ID, via brute-force or through other means, they could then send a POST request to Instagram’s GraphQL endpoint, which exposed display URLs and image URLs, alongside records including like and save counts.
A further vulnerable endpoint was also found that exposed the same information.
In both cases, an attacker could extract sensitive data concerning a private account without being accepted as a follower, a feature of Instagram designed to protect the privacy of users. In addition, the endpoints could be used to extract the addresses of Facebook pages linked to Instagram accounts.
Fartade reported his findings for the first endpoint through the Facebook Bug bounty program on April 16. Facebook’s security team then responded on April 19 with a request for further information including steps for reproduction.
By April 22, the bug bounty hunter’s report had been triaged, and a day later, Fartade found and informed Facebook of the second leaky endpoint.
Facebook patched up the vulnerable endpoints on April 29, however, Fartade says that a further fix was required to fully resolve the security issue.
A financial reward worth $30,000 was awarded by June 15, the bug bounty hunter’s first through Facebook’s program. The social media giant thanked the researcher for his report.
ZDNet has reached out to Facebook and we will update when we hear back.
Previous and related coverage
- Bug bounties: More hackers are spotting vulnerabilities across web, mobile and IoT
- Google paid $6.7 million to bug bounty hunters in 2020
- Microsoft Teams now has its own bug bounties for researchers who can spot security flaws
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0
Enabling developers to create innovative AIs on Messenger and WhatsApp

Every week over 1 billion people connect with businesses on our messaging apps. Many of these conversations are made possible by the thousands of developers who build innovative and engaging experiences on Messenger, Instagram and WhatsApp.
Since opening access to our Llama family of large language models, we’ve seen lots of momentum and innovation with more than 30 million downloads to date. As our messaging services continue to evolve, we believe the technology from Llama and other generative AI models have the potential to enhance business messaging through more natural, conversational experiences.
At Connect Meta announced that developers will be able to build third-party AIs – a term we use to refer to our generative AI-powered assistants – for our messaging services.
We’re making it easy for any developer to get started, so we’re simplifying the developer onboarding process and providing access to APIs for AIs that make it possible to build new conversational experiences within our messaging apps.
All developers will be able to access the new onboarding experience and features on Messenger in the coming weeks. For WhatsApp, we’ll be opening a Beta program in November – if you’re interested in participating please sign up to the waitlist here to learn more.
We’ll keep everyone updated as we make these tools available to more developers later this year. We look forward to your feedback and seeing what you create.
First seen at developers.facebook.com
Introducing Facebook Graph API v18.0 and Marketing API v18.0

Today, we are releasing Facebook Graph API v18.0 and Marketing API v18.0. As part of this release, we are highlighting changes below that we believe are relevant to parts of our developer community. These changes include announcements, product updates, and notifications on deprecations that we believe are relevant to your application(s)’ integration with our platform.
For a complete list of all changes and their details, please visit our changelog.
General Updates
Consolidation of Audience Location Status Options for Location Targeting
As previously announced in May 2023, we have consolidated Audience Location Status to our current default option of “People living in or recently in this location” when choosing the type of audience to reach within their Location Targeting selections. This update reflects a consolidation of other previously available options and removal of our “People traveling in this location” option.
We are making this change as part of our ongoing efforts to deliver more value to businesses, simplify our ads system, and streamline our targeting options in order to increase performance efficiency and remove options that have low usage.
This update will apply to new or duplicated campaigns. Existing campaigns created prior to launch will not be entered in this new experience unless they are in draft mode or duplicated.
Add “add_security_recommendation” and “code_expiration_minutes” to WA Message Templates API
Earlier this year, we released WhatsApp’s authentication solution which enabled creating and sending authentication templates with native buttons and preset authentication messages. With the release of Graph API v18, we’re making improvements to the retrieval of authentication templates, making the end-to-end authentication template process easier for BSPs and businesses.
With Graph API v18, BSPs and businesses can have better visibility into preset authentication message template content after creation. Specifically, payloads will return preset content configuration options, in addition to the text used by WhatsApp. This improvement can enable BSPs and businesses to build “edit” UIs for authentication templates that can be constructed on top of the API.
Note that errors may occur when upgrading to Graph API v18 if BSPs or businesses are taking the entire response from the GET request and providing it back to the POST request to update templates. To resolve, the body/header/footer text fields should be dropped before passing back into the API.
Re-launching dev docs and changelogs for creating Call Ads
- Facebook Reels Placement for Call Ads
Meta is releasing the ability to deliver Call Ads through the Facebook Reels platform. Call ads allow users to call businesses in the moment of consideration when they view an ad, and help businesses drive more complex discussions with interested users. This is an opportunity for businesses to advertise with call ads based on peoples’ real-time behavior on Facebook. Under the Ad set Level within Ads Manager, businesses can choose to add “Facebook Reels” Under the Placements section. - Re-Launching Call Ads via API
On September 12, 2023, we’re providing updated guidance on how to create Call Ads via the API. We are introducing documentation solely for Call Ads, so that 3P developers can more easily create Call Ads’ campaigns and know how to view insights about their ongoing call ad campaigns, including call-related metrics. In the future, we also plan to support Call Add-ons via our API platform. Developers should have access to the general permissions necessary to create general ads in order to create Call Ads via the API platform.Please refer to developer documentation for additional information.
Deprecations & Breaking Changes
Graph API changes for user granular permission feature
We are updating two graph API endpoints for WhatsAppBusinessAccount. These endpoints are as follows:
- Retrieve message templates associated with WhatsAppBusiness Account
- Retrieve phone numbers associated with WhatsAppBusiness Account
With v18, we are rolling out a new feature “user granular permission”. All existing users who are already added to WhatsAppBusinessAccount will be backfilled and will continue to have access (no impact).
The admin has the flexibility to change these permissions. If the admin changes the permission and removes access to view message templates or phone numbers for one of their users, that specific user will start getting an error message saying you do not have permission to view message templates or phone numbers on all versions v18 and older.
Deprecate legacy metrics naming for IG Media and User Insights
Starting on September 12, Instagram will remove duplicative and legacy, insights metrics from the Instagram Graph API in order to share a single source of metrics to our developers.
This new upgrade reduces any confusion as well as increases the reliability and quality of our reporting.
After 90 days of this launch (i.e. December 11, 2023), we will remove all these duplicative and legacy insights metrics from the Instagram Graph API on all versions in order to be more consistent with the Instagram app.
We appreciate all the feedback that we’ve received from our developer community, and look forward to continuing to work together.
Please review the media insights and user insights developer documentation to learn more.
Deprecate all Facebook Wi-Fi v1 and Facebook Wi-Fi v2 endpoints
Facebook Wi-Fi was designed to improve the experience of connecting to Wi-Fi hotspots at businesses. It allowed a merchant’s customers to get free Wi-Fi simply by checking in on Facebook. It also allowed merchants to control who could use their Wi-Fi and for how long, and integrated with ads to enable targeting to customers who had used the merchant’s Wi-Fi. This product was deprecated on June 12, 2023. As the partner notice period has ended, all endpoints used by Facebook Wi-Fi v1 and Facebook Wi-Fi v2 have been deprecated and removed.
API Version Deprecations:
As part of Facebook’s versioning schedule for Graph API and Marketing API, please note the upcoming deprecations:
Graph API
- September 14, 2023: Graph API v11.0 will be deprecated and removed from the platform
- February 8, 2024: Graph API v12.0 will be deprecated and removed from the platform
- May 28, 2024: Graph API v13.0 will be deprecated and removed from the platform
Marketing API
- September 20, 2023: Marketing API v14.0 will be deprecated and removed from the platform
- September 20, 2023: Marketing API v15.0 will be deprecated and removed from the platform
- February 06, 2024: Marketing API v16.0 will be deprecated and removed from the platform
To avoid disruption to your business, we recommend migrating all calls to the latest API version that launched today.
Facebook Platform SDK
As part of our 2-year deprecation schedule for Platform SDKs, please note the upcoming deprecations and sunsets:
- October 2023: Facebook Platform SDK v11.0 or below will be sunset
- February 2024: Facebook Platform SDK v12.0 or below will be sunset
First seen at developers.facebook.com
Allowing Users to Promote Stories as Ads (via Marketing API)

Before today (August 28, 2023), advertisers could not promote images and/or videos used in Instagram Stories as ads via the Instagram Marketing API. This process created unwanted friction for our partners and their customers.
After consistently hearing about this pain point from our developer community, we have removed this unwanted friction for advertisers and now allow users to seamlessly promote their image and/or video media used in Instagram Stories as ads via the Instagram Marketing API as of August 28, 2023.
We appreciate all the feedback received from our developer community, and hope to continue improving your experience.
Please review the developer documentation to learn more.
First seen at developers.facebook.com
-
LINKEDIN1 week ago
Career stories: Influencing engineering growth at LinkedIn
-
OTHER2 weeks ago
WhatsApp iPad Support Spotted in Testing on Latest iOS Beta, Improved Group Calls Interface on Android
-
Uncategorized1 week ago
Vanity Metrics: Definition & Examples for Marketing
-
Uncategorized4 days ago
5 B2B Social Media Marketing Tactics That Actually Work
-
OTHER2 weeks ago
CCI Said to Have Appointed Former WhatsApp Executive, Government Officials as New Members
-
OTHER1 week ago
WhatsApp Passkey Support Reportedly Rolling Out to Beta Testers on Android: How It Works
-
OTHER1 week ago
YouTube Announces AI-Enabled Editing Products for Video Creators
-
Uncategorized1 week ago
Instagram Emoji Guide: Meanings, Reactions, Ideas