In May 2020, I discovered an access-control vulnerability in Facebook Creator Studio's Series feature that could be abused to delete an arbitrary image from Facebook.

The issue occurred because Creator Studio accepted an attacker-controlled image ID when assigning artwork to a Series, but did not properly verify ownership of that image. Once the victim's image had been attached to the attacker's Series, deleting the Series also deleted the referenced image.

Product	Facebook Creator Studio
Feature	Series
Issue	Broken object-level authorization / insufficient ownership validation
Impact	Delete an arbitrary Facebook image
Reported	May 2, 2020
Fixed	May 2, 2020
Bounty	$10,000

Facebook image deletion vulnerability through Creator Studio's Series feature.

Background

Facebook had introduced a Series feature in Creator Studio. A Series could contain media and associated artwork, including Poster Art and a Cover Image.

While reviewing the feature, I noticed that Creator Studio sent image IDs to the backend when artwork was assigned to a Series.

The Series feature in Facebook Creator Studio.

The Vulnerability

After creating a Series and selecting an image for the Poster Art or Cover Image field, Creator Studio sent a request containing the selected image ID.

The request referenced the artwork using an image identifier.

The backend did not sufficiently verify that the supplied image ID belonged to the user creating the Series.

By modifying the request and replacing the legitimate image ID with the ID of another user's image, I could create a Series that referenced the victim's image.

Turning the Reference Into Image Deletion

The more serious behavior appeared when the Series was deleted.

Because the victim's image had been accepted as a property of the attacker's Series, deleting the Series also caused Facebook to delete the referenced image itself.

This created a destructive object-level authorization issue: an attacker who knew or obtained the ID of a target image could associate it with a Series they controlled and then trigger its deletion by removing that Series.

The target image after the deletion was triggered.

Proof of Concept

Resolution

Facebook's security team triaged and fixed the issue on the same day it was reported.

Facebook awarded a $10,000 bounty for the vulnerability.

Disclosure Timeline

May 2, 2020 — 09:10	Vulnerability reported to Facebook.
May 2, 2020 — 10:39	Report triaged.
May 2, 2020 — 22:46	Vulnerability fixed.
June 2, 2020	$10,000 bounty awarded.