2025

• 20 Jun Internal Paths/Files Leakage via Malformed Access Token on graph.meta.ai
• 23 Apr IDOR - Unauthorized Meta Verified Waitlist Modification
• 08 Jan Toggle Messaging Notification for Any Meta Horizon Account

2023

• 11 Mar Exposes Private Facebook/Workplace Videos for any user

2022

• 19 Sep Page Insight Can Add Questions to Pages
• 15 Aug Business Suite (Paid Partnership) - Add Creator to Any Instagram Account

2021

• 13 Nov Mark Marketplace Item as Paid as a Buyer
• 09 Aug Join Workplace Without Approval of Workplace Admin
• 30 Jun Delete Any Ads Reporting Preview Shared with Others

2020

• 11 Oct Block Appointments Requests for Any Facebook Page

2019

• 17 Oct View Reports Ad Account for Any Business (Export via Report ID)
• 17 Oct Bypass Pixel Role (Partner Business)
• 30 Apr Business Partner Can Escalate Role on Block Lists
• 19 Apr Takeover any wit.ai account
• 12 Mar View Draft, Archived and Inactive Effects for Any Facebook or Instagram User
• 12 Mar Delete Groups AR Studio Effect

2018

• 12 Oct Disclosing Private Group Members via Facebook Rooms
• 12 Oct Disclose Page Admins via Facebook Appointments
• 22 May View Pending Email of Any Oculus User via GraphQL