Users from allowed/verified domains could join a Workplace without admin approval using invite link or activation flow.

Buyer-side GraphQL mutations allowed changing a Marketplace listing to 'Paid', deceiving sellers and disabling the 'Mark as paid' control.

Unauthenticated POST to GraphQL could block appointment requests management for any Facebook Page.

In September 2020, a vulnerability was discovered in Facebook's Rooms feature inside Groups that allowed attackers to disclose members of private groups through unauthenticated GraphQL requests.

The vulnerability permits an unauthenticated actor to takeover any wit.ai account. The only prerequisite observed is knowledge of the target wit.ai identifier; no additional credentials are required.

Preview parameter allowed unauthorized viewing of draft, archived, and inactive Spark AR effects for any user.

Using report ID access, an attacker could export Ads Manager reports for arbitrary businesses.

Partner businesses with limited 'apply block list' role could escalate to manage/delete block lists via an insecure add/connections endpoint.

Users without page roles could delete AR Studio Effect groups, removing other users and disrupting creators workflows.

Partner businesses with analyst role could escalate to pixel editor via the sharing_agreement endpoint.