When Disconnecting Isn’t Enough: Instagram Messages Leak via Creator Studio



Affected Feature

Facebook Creator Studio's Instagram account linking system. Creator Studio lets you manage Instagram messages and comments from desktop by connecting your Instagram account to a Facebook Page.

How to Reproduce

  1. Connect an Instagram account to a Facebook Page through Creator Studio
  2. Use Creator Studio to manage that Instagram account's DMs and comments
  3. Go to Facebook settings and disconnect the Instagram account from the Page
  4. Go back to Creator Studio
  5. You still have full access to read and reply to Instagram DMs and comments

The disconnection only removed the visible link. The backend authorization stayed active, so I could keep accessing everything like nothing changed.


Comments

Post a Comment

Popular posts from this blog

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Image
Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...
Read more

Understanding Android’s One-Time Permissions and Their Privacy Implications

Image
You know that moment when you carefully set an app's permissions to "Ask every time"? When you go into Settings, find that app, and make sure it only gets access to your microphone or camera when you explicitly allow it? You feel good about it. You're in control, right? Yeah, about that. I've been testing Android's one-time permission system, particularly with apps like WhatsApp. I set the microphone permission to "Ask every time" because I wanted tight control over when the app could listen. But what I discovered was something that doesn't quite match what Android's documentation promises. Guess what? There's a gap. A small one, but it matters. Wait, How Does This Work? Here's the thing most people don't know: when you close an app after granting one-time permission, Android doesn't always revoke it instantly. Think about it. You finish a WhatsApp call, swipe the app away from your recent apps, and assume that's it...
Read more

Your Android Phone's Dirty Little Secret - Gemini

Image
You know that moment when you're careful about app permissions? When you go into Settings, find that sketchy app, and revoke its access to your camera, location, or files? You feel good about it. You're in control, right? Yeah, about that. I've been using Google Gemini since it launched. I gave it access to pretty much everything - camera, files, location, the works. Recently, I decided to clean things up. Went into Android settings, revoked all of Gemini's permissions, deleted the app, and reinstalled it fresh. Guess what? Gemini still had access to everything. Wait, How Is That Even Possible? Here's the thing most people don't know: Gemini doesn't actually need your permission if you've already given it to the Google app. Think about it. The Google app comes pre-installed on almost every Android phone. During setup, you probably granted it a bunch of permissions without thinking twice. Camera, microphone, location, files - whatever it asked for,...
Read more