Skip to main content

Disclose WhatsApp Number of Instagram Accounts Despite Setting Set to be Hidden

Description

An Instagram Endpoint was leaking WhatsApp number linked with Instagram Accounts

Impact

This bug could've been used to view the WhatsApp number linked with Instagram Accounts despite setting set to be hidden.

Proof of concept

  • Send a GET request to  [ https://i.instagram.com/api/v1/users/[userID]/info/ ]
  • By changing the userID in the above request with a Targeted Professional Instagram Account userID which has a WhatsApp number linked and visibility is set to hide from the profile, the response will disclose the WhatsApp number

Timeline

24 June 2021 - Report Sent
30 June 2021 - Reply From Security Personnel: Need More Info
28 July 2021  - Triaged
06 August 2021 - Fixed By Facebook
19 August 2021 - 1000$ Bounty Rewarded By Facebook