# Change the profanity filter for any Facebook page

Missing authorization on a GraphQL mutation let any user change the profanity filter setting of any Facebook page.

- Payout: $750
- Severity: low
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2020-05-12
- Write-up quality: 6/10
- Original: https://philippeharewood.com/change-the-profanity-filter-for-any-facebook-page/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-change-the-profanity-filter-for-any-facebook-page
- Tags: domain:web3 impact:integrity kind:bounty platform:blog sev:low tech:graphql technique:source-review vuln:access-control vuln:idor

**Target:** Facebook GraphQL API (/api/graphql) page profanity filter mutation
**Root cause:** The GraphQL mutation doc_id 2775555902540880 that sets a page's profanity_filter_id did not verify the caller was an admin of the target page, only that they were authenticated.
**Steps:**
1. Login as page admin and send `new AsyncRequest('/api/graphql').setData({doc_id: 3152386011505033,variables:"{videoID: 1}"}).send()` to read the page's `profanity_filter_id` (e.g. FILTER_OFF).
2. Login as a non-admin attacker and send `new AsyncRequest('/api/graphql').setData({doc_id:2775555902540880,variables:"{input:{actor_id: 2, client_mutation_id:0,page_id: 113702895386410,profanity_setting:'FILTER_MEDIUM'}}"}).send()`.
3. Re-run the read query as admin; `profanity_filter_id` now returns FILTER_MEDIUM, confirming the change.
**How found:** Researcher noticed the new profanity filter feature, captured the GraphQL doc_id used by the admin UI to read the setting, then tested whether the corresponding mutation doc_id enforced page-admin authorization by replaying it from a non-admin session.
**Exploitation:** Any authenticated user could invoke the persisted GraphQL mutation with an arbitrary page_id and profanity_setting, altering the page's comment filter without admin rights.
**Insight:** Facebook's persisted GraphQL doc_ids bypass the arbitrary-query block; capture the doc_id from the admin UI request and replay the mutation from a low-privilege account to test per-object authorization on new feature mutations.