A security researcher says he has received a significant bug bounty from Meta after discovering a critical vulnerability that exposed customer support data.
The vulnerability was discovered and reported to Meta in January 2026 by independent researcher Rony K Roy. The initial report to the social media giant described a security hole of limited severity, but further analysis revealed that the flaw’s impact was much higher than initially believed.
According to Roy, Meta rolled out patches in April and had not found any evidence of malicious exploitation.
The researcher disclosed his findings last week and told SecurityWeek that he received a $78,000 bug bounty from Meta.
Meta has not responded to SecurityWeek’s request to confirm Roy’s claims, but he is indeed listed as one of the top researchers on the company’s bug bounty leaderboard for 2026.
Roy initially believed he had identified an authorization issue in Meta Horizon Managed Solutions, an enterprise platform for managing Meta Quest devices and users. It turned out to be a broader issue affecting Meta’s backend support infrastructure.
The researcher’s analysis led to the discovery of a vulnerability involving missing authorization, broken access control, and insecure direct object reference (IDOR) issues.
When chained, these flaws could have been exploited to enumerate Meta support case numbers and obtain support requests.
According to Roy, an attacker could have exploited the vulnerability to obtain email and chat conversations between users and Meta support, support case details, files submitted to the company via support requests, and personal and contact information shared by users with Meta support.
In addition, an attacker could have created support requests on behalf of organizations that use Meta Horizon Managed Solutions, modified support workflows (including changing case status), and added unauthorized subscribers to support cases.
Related: Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
Related: Zimbra Update Patches Critical Vulnerabilities
Related: OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
