Facebook PageAnalyst Could Add oneself as Moderator on Group
11 Jan 2019 - onehackzero
There is a call to add member as the moderator on a group. The call at the time didn’t seem to have any authorisation checks to page roles. A page analyst was possible to add oneself as a moderator on a linked group.
Proof of Concept
- Dec 19, 2018 - Report Sent
- Dec 22, 2018 - Further investigation by Facebook
- Jan 9, 2019 - Fixed by Facebook
- Jan 11, 2019 - Bounty Awarded by Facebook