# Image removal vulnerability in Facebook polling feature

Facebook Polls accepted an attacker-supplied associated_image_id without ownership checks, letting attackers attach a victim's image to their poll and delete it by deleting the poll.

- Payout: $10,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Pouya Darabi
- Disclosed: 2017-11-25
- Write-up quality: 6/10
- Original: https://blog.darabi.me/2017/11/image-removal-vulnerability-in-facebook.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2017-11-image-removal-vulnerability-in-facebook-html
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:source-review vuln:access-control vuln:idor

**Target:** Facebook Polls poll-creation endpoint (poll_question_data[options][][associated_image_id])
**Root cause:** Backend accepted an attacker-controlled image ID for poll options without verifying the image belonged to the requesting user. Deleting the poll cascaded to delete the referenced image.
**Steps:**
1. Create a poll with an image option; capture the request containing `poll_question_data[options][][associated_image_id]=<own_id>`.
2. Replace the value with a victim's image ID: `poll_question_data[options][][associated_image_id]=<victim_id>`.
3. Submit; Facebook creates the poll referencing the victim's image.
4. Delete the attacker's poll; the referenced victim image is deleted as a side effect.
**How found:** Newly launched Polls feature prompted review of its request flow and how media was attached to poll options; noticed the client-supplied associated_image_id parameter and tested substituting another user's image ID.
**Exploitation:** Attacker needs a target image ID, submits a poll-creation request with the victim's associated_image_id, then deletes their own poll to trigger deletion of the victim's image.
**Insight:** New features that reference existing objects by client-supplied ID are prime IDOR targets; check not just read/write of the referenced object but cascade-delete side effects when the parent object is removed.