# Responsible disclosure: retrieving a user's private Facebook friends.

Instagram suggested Facebook friends before email confirmation, letting anyone sign up with a victim's email and read their private Facebook friend list.

- Payout: $3,000
- Severity: high
- Program: Meta / Facebook
- Credited: Riccardo Padovani
- Disclosed: 2018-09-23
- Write-up quality: 6/10
- Original: https://rpadovani.com/facebook-responsible-disclosure
- Library page: https://bugbountylibrary.com/r/blog%3Arpadovani-com-facebook-responsible-disclosure
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:email technique:chained vuln:access-control vuln:info-disclosure

**Target:** Instagram signup and follow-suggestion feature linked to Facebook account
**Root cause:** Instagram auto-linked new accounts to an existing Facebook account by matching email, and exposed Facebook-friend-based follow suggestions before the signup email was confirmed, so the email owner was never verified.
**Steps:**
1. Obtain target's email address
2. Sign up to Instagram using that email (no email confirmation required to use features)
3. Instagram auto-links the new account to the Facebook account sharing that email
4. Open 'suggested people to follow' to view the linked Facebook account's friends
**How found:** Noticed Instagram enables features pre-email-confirmation and that it links accounts by matching email, hypothesizing the friend-suggestion feature would leak the linked Facebook account's private data.
**Exploitation:** Attacker registers an Instagram account with the victim's email; before confirming the email, the follow-suggestion feature reveals the victim's Facebook friends regardless of privacy settings or friendship status.
**Insight:** Pre-verification feature access combined with implicit account linking by email is a data-leak vector: test what a freshly registered, unconfirmed account can see about the email's real owner.