vulns.co
/
GKData.io MCP

AZAuthorization and tenant boundaries · 2 min read

Instagram embedding fallback changed the authorization context

The researcher documents USD 14,500 for one report: a 10,000 base bounty and two event bonuses.

Read the primary source AZAuthorization and tenant boundariesReviewed 2026-10-02

Root cause

A client-specific error path retrieved media under an elevated service identity, losing the original requester’s privacy constraints.

Demonstrated impact

Private post text and media could be exposed. The researcher did not establish the same effect for profile embedding.

Lessons for review

  • Preserve requester authorization across error handling and fallback paths.
  • Keep policy decisions consistent across client-specific code paths.
  • Distinguish demonstrated data exposure from unverified adjacent features.

Award and evidence

USD 14,500Bug Bounty · Researcher Reported

One report: 10,000 base plus 2,000 and 2,500 bonuses. Classified as a bug bounty with event bonuses, not a separate placement prize. The article uses $; USD is contextualized by Facebook’s official program and BountyCon reporting, which predates this award.

Read researcher timeline, bounded impact and attributed vendor explanation. Summed only the three reward components explicitly attached to this report; used official program context for USD notation.

  • Researcher-reported award, not independent vendor confirmation or audited settlement.
  • Currency context comes from an earlier official program retrospective, not a reproduced award receipt.
  • The account-restriction root cause is the researcher’s account of vendor clarification.

Recorded timeline

Published
2023-10-12explicit
Reported
2022-09-20explicit
Awarded
2022-09-25explicit · All three report-linked reward components share this timeline date.

Related visual models

A failure retains the original caller, action and resource. An explicit access denial stops without protected data. A known recoverable operational failure can propose a fallback, but switching execution identity grants no extra caller entitlement. A separate application-policy decision evaluates that fallback for the original caller. Denied or indeterminate decisions stop without protected data. A permitted, scoped fallback returns only caller-permitted data.

Conceptual model Diagram

Fallbacks must preserve the original caller's authority

Original editorial defensive synthesis of the Instagram embedding disclosure and OWASP authorization guidance. The researcher attributes the disclosure to error handling that retrieved protected content under an…

Reviewed 2026-10-04Read

Sources and provenance

  1. How I Exposed Instagram's Private Posts by Blocking Users 003random · reviewed 2026-10-02
  2. Facebook Bug Bounty and BountyCon US-dollar reporting Dan Gurfinkel / Facebook · reviewed 2026-10-02

Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.

GitHub snapshot 2026-10-04

d5550c789111 · JSON exports & schemas · CC BY 4.0 content / MIT software