A security vulnerability in Facebook business manager endpoint GIVES/ALLOWS a third party app to hack any Facebook page with limited permissions and the victim will HAVE TO permanently lose admin access to the page.
By default Facebook app interface do not allow third party apps to add or modify page admin roles (page roles like manager, editor, analyst etc..). Third party apps are allowed to perform all the operations like post statuses on your behalf, publish photos, etc.. except adding admin roles because if an app is allowed to add or remove admins then it could add some user as admin to the page and remove the actual owner forever.
In the other hand there is an endpoint for business pages called user permissions which allow to add/remove page admin roles who are already handling the Facebook business.
Following request would make target user as admin of the page.
No comments:
Post a Comment