Dynamic World

I discovered a vulnerability in Facebook that allowed a normal user in ad account to get unauthorized admin access in that ad account

admins in ad account  can add any user to their ad account with these 3 type of  role :

1. admin
2. advertiser
3. analyst

read more about these roles link