Critical Meta IDOR Flaw Let Attackers Access Customer Support Cases

A critical broken access control flaw in Meta’s customer support infrastructure (originating in Horizon Managed Solutions and shared backend services) allowed unauthorized access to private support emails, chat transcripts, case metadata, attachments, and the ability to manipulate support cases and subscribers; the issue mapped to multiple authorization-related CWEs, was reported in January 2026, patched by April 2026 with a $78,000 bounty, and the public write-up omits exploit details to avoid reproduction.