Page Admin Disclosure via an Upgraded Page Post



Steps to replicate

  • UserB = Stalker/Attacker
  1. Using UserA, create a public post on the Page you are managing. Make sure that such post is congratulatory-worthy or something that would pop out the Life Event message enabling such post to be upgraded.

2. [Still UserA’s perspective] Once already posted, notice a prompt message on top of it saying: “It looks like something special happened. Want to make this post a life event?” which is then giving me two options, one is “No Thanks” which declines the post being upgraded and the other is “Upgrade Post” that enables such post to be upgraded. Click on the “Upgrade Post” button and supply the necessary details.

3. [Still UserA’s perspective] Go to your profile’s About Section Life Events [base url/username/about?section=year-overviews] and notice that the Life Event you posted via your page is listed there.

Or simply, go to your profile, scroll down to your Life Events section to verify.

4. [UserB’s perspective] UserB goes to UserA’s profile and clicks on any of UserA’s Life Events, it redirects UserB to the Page Post thereby validating/disclosing that UserA is an admin of that Page since it was linked to his or her personal account as a Life Event.


POC (Proof-of-Concept)


January 09, 2020 :: Triaged after several discussions

“Hi Dan, Thanks for your patience and for reporting this information to us. We are sending it to the appropriate product team for further investigation. We will keep you updated on our progress. Thanks”

February 06, 2020 :: Fixed the bug

February 07, 2020 :: Bounty awarded

Got myself listed on Facebook’s Whitehat Hacker Hall-of-Fame (2019)
Number 65:


Ajay Gautam :

AJ Dumanhug :


  • Understand the platform’s features if it is showing any unusual behavior, and/or if privacy has been bypassed, then find strong, supporting details with what you found and discuss with them (security team) why that’s happening and why that’s a security issue to deal with.

Thanks for reading!

Connect with me on LinkedIn!



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store