# Bypass ad account roles vulnerability 2015

Facebook Ads Manager permission endpoint failed to check requester's role, letting an Analyst add a user as Admin and seize ad-account control.

- Payout: $8,000
- Severity: high
- Program: Meta / Facebook
- Credited: Pouya Darabi
- Disclosed: 2015-05-15
- Write-up quality: 6/10
- Original: https://blog.darabi.me/2015/03/facebook-bypass-ads-account-roles.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-03-facebook-bypass-ads-account-roles-html
- Tags: domain:web impact:integrity impact:privesc kind:bounty platform:blog sev:high technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** POST /ads/manage/settings/permissions/?action=add_user endpoint
**Root cause:** The add_user endpoint did not verify whether the requesting user held sufficient role to assign the requested permission level, only that they had some access to the ad account.
**Steps:**
1. Obtain Analyst-level access to a shared ad account via Business Manager.
2. Send `POST /ads/manage/settings/permissions/?action=add_user` with `act=[AD_ACCOUNT_ID]`, `user_id=[USER_ID]`, `add_user_permission=1001`, and valid `fb_dtsg` token.
3. Permission 1001 maps to Admin; target user is added as administrator.
4. Log in as the newly added admin to control the ad account.
**Exploitation:** A lower-privileged agency account submits the permission-management request directly with add_user_permission=1001, creating an admin user it controls and thereby taking over the ad account.
**Insight:** When a UI hides role-assignment controls, test the underlying permission endpoint directly with the highest role value — backend often checks account membership but not the requester's role for the assignment action.