A bug during a Facebook test recently exposed the personal information like email addresses and birthdays of Instagram users, the media reported.
Saugat Pokharel, an experienced bug hunter from Nepal, discovered the bug.
The attack used Facebook’s Business Suite tool, available to any Facebook business account, reports The Verge.
Pokharel found that the attack worked on accounts that were set to private and account that were set to not accept DMs from the public.
“If an account did not accept DMs, the user potentially would not receive any notification indicating their profile may have been viewed,” the report said on Friday.
Facebook patched vulnerability after being reported.
According to a Facebook spokesperson, the bug was only accessible for a short period of time during a small test.
“A researcher reported an issue where, if someone was a part of a small test we ran in October for business accounts, personal information of the person they were messaging could have been revealed,” the company spokesperson was quoted as saying.
“This issue was resolved quickly, and we discovered no evidence of abuse. Through our Bug Bounty Program we rewarded this researcher for his help in reporting this issue to us”.
Pokharel earlier found another bug on Instagram and awarded a $6,000 bug bounty payout. He found that Instagram retained photos and private direct messages on its servers long after he deleted them.
The company fixed the bug and allowed Pokharel to disclose the bug issue.
