Ethical Hacker Finds Meta Security Flaw That Could Reveal Support Records, Earns $78,000

A security researcher has bagged a $78,000 bug bounty from Meta after discovering a flaw that could have exposed sensitive customer support records, including private conversations, uploaded files, and user contact details.

Independent researcher Rony K. Roy discovered the vulnerability in January 2026 while reviewing Meta Horizon Managed Solutions, a platform that businesses use to manage Meta Quest devices and users. Initially, the issue appeared to be isolated. Further investigation, however, suggested it could also affect larger back-end systems that support customer service operations.

Roy alerted Meta about the discovery, prompting the company to fix the issue in April. He said that Meta's investigation found no evidence that hackers were able to access affected systems before the vulnerability was resolved.

A Small Security Flaw Led to a Bigger Discovery

At first, Roy thought he was dealing with a minor authorisation bug in Meta Horizon Managed Solutions. The deeper he dug, the more he found.

His investigation uncovered several vulnerabilities across Meta's support systems that could have been chained together to expose Meta support account numbers and sensitive customer support records. The issues included missing authorisation checks, broken access controls, and IDOR flaws that could have enabled unauthorised access to support records. The findings prompted Meta to investigate the reported issues and implement fixes.

Private Messages, Files, and User Details at Risk

The security flaw could have exposed more than technical weaknesses, potentially giving attackers access to information shared through Meta's customer support channels.

Roy's analysis showed that attackers could potentially gain access to:

• User conversations with Meta support representatives
• Customer support case information
• Files attached to support requests
• User contact information

The issue also extended beyond viewing records. The flaw could have allowed attackers to tamper with support cases, modify workflows, and add unauthorised subscribers. Moreover, such access would have increased the risk for data exposure, account impersonation, and disruption of support services.

Meta Fixed the Bug Before It Was Exploited

According to Roy, Meta addressed the issue in April after assessing his report and said it found no evidence that the vulnerability had been exploited before it was fixed. The researcher later shared the details of the discovery publicly and revealed that Meta awarded him a $78,000 bounty for responsibly reporting the security flaw.

Although Meta has not publicly released its own technical account of the vulnerability, Roy is listed among the top security researchers on its 2026 bug bounty leaderboard. Meta has emphasised the importance of its bug bounty community, saying, 'Our bug bounty community plays an important role in helping us identify and address security issues.'

Ethical Hackers Play a Key Role in Finding Security Flaws

Before cybercriminals can discover a vulnerability, ethical hackers often work behind the scenes to find weaknesses that could otherwise put customer information at risk. Through bug bounty initiatives, companies can collaborate with independent researchers by offering financial rewards. It also gives companies the chance to resolve these issues before attackers can exploit them.

The findings show how a seemingly minor permissions issue can have much wider security implications, especially for customer support platforms that store sensitive information. With companies relying on online systems to support customers and manage their data, identifying and fixing vulnerabilities before they are exploited has become a critical part of cybersecurity. Responsible disclosure and routine security testing remain key to reducing that risk.