writeups.xyz / Business user Employees could have applied block list to all ad accounts listed in the business manager.

Submitter : c2a

Date: 17 June 2019

Bounty : 500

Vulnerabilities :

• Broken Authorization
• Logic Flaw

Programs :

• Meta / Facebook

Authors :

• Rohit Kumar (@Rohitcoder)

Link :
https://medium.com/@rohitcoder/business-user-employees-can-add-edit-change-or-apply-block-list-to-a-business-account-7b3e8aae667e