An IDOR vulnerability in Facebook Events allowed attackers to add any user—including non-friends and blocked contacts—as co-hosts to personal events by tampering with the co_hosts parameter in the event creation request. The vulnerability was patched by Facebook and rewarded $750 through their bug bounty program.
An IDOR vulnerability in Facebook Analytics allows users with analyst roles to access private dashboard charts by manipulating the chartID parameter in GraphQL requests, disclosing chart names and data intended only for the dashboard owner. The vulnerability exploits insufficient access control on a sub-option (chart info) within the main dashboard feature.
An IDOR vulnerability in Facebook's video poll feature allows attackers to delete polls from other users' videos by manipulating the deleted_poll_ids parameter in POST requests to the video editing endpoint.