Instagram Investigates Reported Vulnerability Allowing Access to Private Content

A researcher reported a server-side authorization failure in Instagram's mobile web interface that could return private account content (full-resolution photos, captions) via unauthenticated GET requests with specific mobile headers. The researcher provided timestamped video, PoC scripts, network logs, screenshots, and correspondence; Meta initially misclassified the issue as CDN caching, then patched affected accounts within days without explicit acknowledgement or clear root-cause analysis, raising concerns about disclosure handling and residual risk.