# Facebook Page Admin Disclosure

A group share link in a Page's mobile inbox showed a join button that sent a join request as the Page admin without consent.

- Payout: $3,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Rahul Kankrale
- Disclosed: 2020-10-21
- Write-up quality: 6/10
- Original: https://servicenger.com/blog/mobile/facebook-page-admin-disclosure/
- Library page: https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-facebook-page-admin-disclosure
- Tags: domain:mobile domain:web impact:integrity kind:bounty platform:blog sev:medium technique:recon vuln:access-control vuln:business-logic

**Target:** Facebook mobile Page inbox group-share link preview
**Root cause:** The mobile Page inbox rendered a group-share link preview with a join (+) button that acted using the Page's identity rather than the viewing user's, so clicking it submitted a join request as the Page admin.
**Steps:**
1. Login as UserOne, switch to interacting as PageOne in GroupOne.
2. Click Share, choose 'Share in private message', search victimPage, send.
3. Login as victimUser on mobile, open victimPage inbox, find the group link preview with a + button.
4. Click +; a join request is sent as victimPage admin without consent.
5. Verify as UserOne: notification shows victimUser asked to join.
**How found:** Noticed the mobile Page inbox link preview rendered a join (+) button that acted on the Page identity, unlike web where the link displayed normally.
**Exploitation:** Attacker (any user) shares a group link to a victim Page's inbox; when the Page admin views it on mobile and taps the + join button, a join request is submitted under the Page's identity without their knowledge.
**Insight:** Compare how the same shared link renders across web vs mobile clients; a UI affordance (join button) in a Page-context inbox may execute actions under the Page identity rather than the viewer's.