Meta Paid a Researcher $78,000 to Find a Flaw That Exposed Support Chats and Personal Data
An independent security researcher discovered a hole in Meta's internal support system that could have let anyone read private conversations between users and Meta support staff. Meta patched it. Then came the cheque.
Key points
- Researcher Rony K Roy reported a security flaw to Meta in January 2026 and received a $78,000 bug bounty payment.
- The flaw sat inside Meta's backend support infrastructure and affected users of Meta Horizon Managed Solutions, an enterprise platform for managing Meta Quest headsets.
- An attacker could have read private email and chat conversations between users and Meta support without any special permission.
- Meta rolled out patches in April 2026 and found no evidence that anyone had exploited the flaw before it was fixed.
- Roy appears on Meta's official bug bounty leaderboard for 2026, lending weight to his account, first reported by SecurityWeek.
A security researcher found a serious flaw buried in Meta's customer support system and walked away with $78,000. The story behind that number is worth understanding.
Rony K Roy, an independent researcher, flagged what looked like a minor authorisation problem (a flaw controlling who is allowed to see what) inside Meta Horizon Managed Solutions in January 2026. That product lets businesses manage fleets of Meta Quest virtual-reality headsets. Routine stuff, on the surface.
Dig deeper, and the picture changed.
Further analysis revealed three overlapping weaknesses: missing authorisation checks, broken access controls, and something called an insecure direct object reference, or IDOR, where a system hands out internal record identifiers in a predictable way, letting anyone who guesses the pattern pull up records they should never see. Chained together, those flaws reached well beyond Horizon Managed Solutions into Meta's broader support backend. We covered a structurally similar case on 11 June in ServiceNow's unauthenticated API endpoint exposure, where default misconfiguration quietly unlocked tenant data.
What could an attacker actually have done?
Quite a lot. Someone exploiting this flaw could have read private email and live-chat conversations between ordinary users and Meta's support team, downloaded attached files from support tickets, seen personal contact details shared during those conversations, and listed open support cases by cycling through case numbers.
Beyond reading data, an attacker could have filed fake support requests on behalf of companies, changed case status, and added themselves as a subscriber to cases they had no business seeing. That last point matters. Support conversations often contain sensitive material: account details, billing queries, identity documents uploaded to prove ownership of a hacked account. Quietly subscribing to those conversations would give an attacker a steady feed of it.
Meta patched the vulnerability in April 2026 and told Roy it had found no sign of malicious use. That's the best realistic outcome when a flaw like this surfaces through a legitimate bug bounty report rather than criminal exploitation.
Should stronger authentication have helped?
Partly. But the core problem was that the system didn't check permissions carefully enough in the first place. Multi-factor authentication (MFA, a second proof of identity beyond a password) stops uninvited people from logging in. It doesn't stop a logged-in user from wandering into rooms the system should have kept locked.
The $78,000 payout reflects how seriously Meta graded the potential damage. Roy's disclosure also came the same week Meta's AI training programme was under scrutiny for internal data-access gaps, a thread we'd been following since our 24 June report. For ordinary Meta users who've ever contacted support, there's nothing to do right now. No data is confirmed stolen. Watch your inbox for anything unexpected from Meta support, but the risk appears contained.
