Unauthenticated POST to GraphQL could block appointment requests management for any Facebook Page.

In September 2020, a vulnerability was discovered in Facebook's Rooms feature inside Groups that allowed attackers to disclose members of private groups through unauthenticated GraphQL requests.

The vulnerability permits an unauthenticated actor to takeover any wit.ai account. The only prerequisite observed is knowledge of the target wit.ai identifier; no additional credentials are required.

Preview parameter allowed unauthorized viewing of draft, archived, and inactive Spark AR effects for any user.

Using report ID access, an attacker could export Ads Manager reports for arbitrary businesses.

Partner businesses with limited 'apply block list' role could escalate to manage/delete block lists via an insecure add/connections endpoint.

Users without page roles could delete AR Studio Effect groups, removing other users and disrupting creators workflows.

Partner businesses with analyst role could escalate to pixel editor via the sharing_agreement endpoint.

This vulnerability permits the leakage of the page owner's identifier.

A GraphQL endpoint exposed pending (unconfirmed) email addresses for Oculus users by ID, leaking PII.