writeups.xyz / Access private information about SparkAR effect owners who has a publicly viewable portfolio

Submitter : c2a

Date: 17 February 2021

Bounty : 1,500

Vulnerabilities :

• Broken Authorization
• Information Disclosure
• GraphQL

Programs :

• Meta / Facebook

Authors :

• Youssef Sammouda (@Samm0uda)

Link :
https://ysamm.com/?p=621