# Create living room polls as a Facebook page analyst

A page analyst could create polls on any page's Watch Party via a GraphQL mutation using the page's actor_id, bypassing role restrictions.

- Payout: $5,000
- Severity: low
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2019-08-24
- Write-up quality: 6/10
- Original: https://philippeharewood.com/create-living-room-polls-as-a-facebook-page-analyst/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-create-living-room-polls-as-a-facebook-page-analyst
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:low tech:graphql technique:source-review vuln:access-control vuln:business-logic

**Target:** Facebook GraphQL /api/graphql/ living_room_poll_create mutation
**Root cause:** The living_room_poll_create GraphQL mutation did not verify that the actor had poll-creation privileges on the target watch party, only that the actor_id was a page the user had any role on.
**Steps:**
1. Create a watch party in a group; note URL /groups/GROUP_ID/wp/WATCH_PARTY_ID/
2. As a page analyst in a separate browser profile, set `doc_id='2'`, `fb_api_caller_class='RelayModern'`, `variables="{input:{client_mutation_id:0,actor_id:ACTOR_ID,living_room_id:WATCH_PARTY_ID,question:'where',options:['a','b','c']}}"`, `av='ACTOR_ID'`
3. Send `new AsyncRequest('/api/graphql/').setData({variables,doc_id,fb_api_caller_class,av}).send()`
4. Poll is created on the target watch party on behalf of the page
**How found:** Researcher noticed analysts could create polls and tested whether the actor_id/living_room_id binding was enforced by replaying the mutation with a mismatched watch party ID.
**Exploitation:** An analyst of any page supplies that page's actor_id and an arbitrary living_room_id (watch party) in the GraphQL mutation; the server creates the poll on the target party despite the analyst lacking poll rights there.
**Insight:** GraphQL mutations that take both an actor_id and a resource id often validate the actor's role but not the actor's permission on the specific resource; try mismatching actor_id vs resource id to test authorization binding.