Critical Meta IDOR Flaw in Support Case Infrastructure Exposed Customer Emails, Transcripts, and Internal Notes (Meta Horizon Managed Solutions / Meta.com Support)
Critical Meta IDOR Flaw in Support Case Infrastructure (TL-2026-1620), also tracked as Meta Support Case IDOR, is a critical-severity software vulnerability, first published 2026-07-22. It has no confirmed attribution, affects Meta Platforms, Inc. Meta.com Customer Support Portal, maps to 15 MITRE ATT&CK techniques (T1069, T1078, T1087), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-1620
- Threat ID
- TL-2026-1620
- Also known as
- Meta Support Case IDOR, Meta Horizon Managed Solutions IDOR
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
A chained Insecure Direct Object Reference (CWE-639), Broken Access Control (CWE-284), and Missing Authorization (CWE-862) flaw in Meta's customer support case infrastructure — spanning Meta.com support workflows, Meta Horizon Managed Solutions, and a Meta-integrated Salesforce Service Cloud backend — allowed unauthorized enumeration and retrieval of support emails, case records, live chat transcripts, and internal support notes belonging to other organizations, as well as unauthorized creation of tickets, modification of case status, and addition of subscribers to cases. Independent researcher Rony K Roy (aka WhiteAuth) reported the issue to Meta in January 2026; Meta remediated it in April 2026, paid a $78,000 bug bounty, and found no evidence of in-the-wild exploitation. Roy publicly disclosed the findings on 2026-07-17.
How Critical Meta IDOR Flaw in Support Case Infrastructure works
In January 2026, independent security researcher Rony K Roy (publishing under the handle WhiteAuth) was evaluating Meta Horizon Managed Solutions — Meta's enterprise platform for administering Meta Quest devices and managed-user fleets — when he identified what initially appeared to be an isolated authorization weakness in its support-case workflow. Deeper analysis revealed that the weakness was not isolated to Horizon: it stemmed from a shared backend used across multiple Meta support channels, including the consumer-facing Meta.com support portal, and a Meta-integrated instance of Salesforce Service Cloud used as the underlying case-management system.
The root cause was a combination of three chained weaknesses: (1) support case records were assigned sequential, predictable identifiers (CWE-639, Insecure Direct Object Reference); (2) the support API/application layer did not consistently verify that the requesting principal owned or was authorized to view/modify a given case (CWE-284, Broken Access Control); and (3) certain case-management endpoints omitted authorization checks entirely (CWE-862, Missing Authorization). Because the underlying Salesforce platform itself enforced its own access controls correctly, the flaw was specific to how Meta's application layer queried and exposed Salesforce-backed case objects — Salesforce was not itself vulnerable.
Chaining sequential-ID enumeration with the missing/broken authorization checks meant that any authenticated (in some paths, potentially any) party could iterate through support case identifiers and pull back another organization's case emails, live chat transcripts, internal support-agent notes, escalation details, case summaries, and file attachments — data that frequently contained customer PII (names, email addresses, phone numbers) embedded in confidential operational communications. Beyond read access, the same lack of ownership verification let an attacker create new support tickets impersonating another organization, change the status of an existing case (e.g., closing or reopening cases that were not theirs), and add unauthorized subscribers/watchers to a case thread — extending unauthorized visibility into ongoing support conversations after the fact.
Roy reported the finding to Meta through the Meta Bug Bounty program in January 2026. Meta investigated, developed a fix that added proper per-case authorization/ownership checks across the affected surfaces, and rolled it out in April 2026. Meta stated it found no evidence that the flaw had been exploited by malicious actors prior to remediation. Meta subsequently paid Roy a $78,000 bounty, and he is listed among the top researchers on Meta's 2026 bug bounty leaderboard. Roy publicly disclosed technical details of the finding on 2026-07-17; the disclosure was covered by SecurityWeek on 2026-07-21 and by GBHackers on 2026-07-22. No CVE has been assigned, as this is a first-party SaaS/vendor-operated infrastructure flaw rather than a distributable software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1620
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery
Defense Evasion
Persistence
Collection
T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Initial Access
T1190 Exploit Public-Facing Application
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Reconnaissance
T1592 Gather Victim Host Information; T1594 Search Victim-Owned Websites; T1595 Active Scanning
Affected products and versions in Critical Meta IDOR Flaw in Support Case Infrastructure
- Meta Platforms, Inc. — Meta.com Customer Support Portal
Vulnerable versions: production, pre-April 2026
Fixed in: production, post-April 2026 patch - Meta Platforms, Inc. — Meta Horizon Managed Solutions
Vulnerable versions: production, pre-April 2026
Fixed in: production, post-April 2026 patch - Meta Platforms, Inc. (Salesforce-integrated backend) — Meta support case-management system built on Salesforce Service Cloud
Vulnerable versions: production, pre-April 2026 (Meta application layer; underlying Salesforce platform was not vulnerable)
Fixed in: production, post-April 2026 patch
Remediation for Critical Meta IDOR Flaw in Support Case Infrastructure
Patches
- Meta deployed a backend authorization fix in April 2026 adding per-case ownership verification across Meta.com support, Meta Horizon Managed Solutions, and the Salesforce-integrated case backend
Immediate actions
- Confirm the Meta-deployed April 2026 patch is applied across all affected surfaces (Meta.com support, Meta Horizon Managed Solutions, Salesforce-integrated backend)
- Audit support-case access logs for anomalous sequential case-ID access patterns predating the patch
- Review any organizational support cases for unauthorized status changes, added subscribers, or tickets created on the organization's behalf between case-system deployment and April 2026
Longer-term hardening
- Replace sequential/predictable object identifiers with non-guessable UUIDs for all customer-facing case/ticket records
- Enforce object-level authorization (ownership/ACL checks) at the API layer for every case read, write, status-change, and subscriber-management endpoint, independent of underlying platform (e.g., Salesforce) access controls
- Apply the OWASP IDOR Prevention guidance: centralize authorization checks, avoid exposing internal/sequential primary keys in client-facing APIs, and add automated IDOR regression tests to CI for support/case-management systems
- Extend bug bounty scope and internal red-team coverage to first-party SaaS-integrated backends (not just directly-owned codebases), given this flaw lived at the integration boundary rather than in Salesforce itself
Weaknesses (CWE) in Critical Meta IDOR Flaw in Support Case Infrastructure
CWE-639, CWE-284, CWE-862
Timeline of Critical Meta IDOR Flaw in Support Case Infrastructure
- Independent researcher Rony K Roy (WhiteAuth) discovers the authorization weakness while testing Meta Horizon Managed Solutions and reports it to Meta via the Meta Bug Bounty program (January 2026, exact day not disclosed).
- Further analysis by the researcher shows the flaw is not isolated to Horizon but affects a shared backend also used by Meta.com support workflows and a Salesforce Service Cloud-integrated case-management system.
- Meta deploys a backend patch adding per-case authorization/ownership verification across the affected support surfaces (April 2026, exact day not disclosed).
- Meta confirms it found no evidence of malicious exploitation of the flaw prior to remediation.
- Meta pays Rony K Roy a $78,000 bug bounty for the finding; Roy is subsequently listed among the top researchers on Meta's 2026 bug bounty leaderboard.
- Rony K Roy publicly discloses technical details of the IDOR/broken access control chain.
- SecurityWeek publishes coverage of the disclosure, confirming the $78,000 bounty and timeline details.
- GBHackers publishes a technical summary of the vulnerability chain and its impact.
Sources cited for Critical Meta IDOR Flaw in Support Case Infrastructure
Threats related to Critical Meta IDOR Flaw in Support Case Infrastructure
- Broken Object-Level Authorization (BOLA) in Airline GraphQL Booking API Exploited via Autonomous AI Red-Team Agent
- CVE-2026-2031 "StubZero": Remote Code Execution in Google Cloud Application Integration via Exposed Proto Descriptors, GenericStubbyTypedTaskV2 and ACL Bypass
- CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing
- Claude-Powered AI Agent (OpenClaw) Autonomously Exploits Broken Access Control Flaw in Gym Booking API
- FIFA World Cup 2026 Broadcast API Broken Access Control (Missing Server-Side Authorization) Allowed Live TV Stream Takeover
- SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access Control
Detection coverage for TL-2026-1620
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1620 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.