# Another image removal vulnerability on Facebook

Creator Studio Series accepted attacker-supplied image IDs without ownership checks, letting attackers attach a victim's image and delete it by deleting the Series.

- Payout: $10,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Pouya Darabi
- Disclosed: 2020-06-04
- Write-up quality: 6/10
- Original: https://blog.darabi.me/2020/06/image-removal-vulnerability-on-facebook.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2020-06-image-removal-vulnerability-on-facebook-html
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:source-review vuln:access-control vuln:idor

**Target:** Creator Studio Series artwork assignment API (image ID parameter)
**Root cause:** Backend accepted an attacker-controlled image ID when assigning Series artwork without verifying the caller owned that image; deleting the Series cascaded to delete the referenced image.
**Steps:**
1. Create a Series in Creator Studio and select an image for Poster Art/Cover Image.
2. Capture the request containing the legitimate image ID.
3. Replace the image ID with the victim's image ID and submit; Series now references victim's image.
4. Delete the Series; backend deletes the referenced victim image.
**How found:** While reviewing the Series feature, noticed Creator Studio sent image IDs to the backend when assigning artwork, then hypothesized ownership wasn't validated and tested by swapping in another user's image ID.
**Exploitation:** Attacker needs the target image ID, swaps it into the Series artwork request to bind the victim's image to their own Series, then deletes the Series to trigger cascading deletion of the victim's image.
**Insight:** When a feature stores references to objects by ID, test whether delete/cleanup cascades on the parent also act on the referenced object without re-checking ownership — turning a harmless IDOR reference into destructive deletion.