Page admin disclosure

These guidelines show how we determine impact for Page admin disclosures. This category has a wide range of potential bounty amounts as they are dependent on the list of factors below. We typically cap Page admin disclosures at $5,000* and then apply any applicable deductions to arrive at the awarded bounty amount. We do not share exact deduction amounts as they are subject to change.

Payouts

up to

$5k*

These are the factors we consider when deducting from the maximum payout:

Page admin needs to take an action:

If Page admin interaction is required in some way, then this cannot be abused at scale. This greatly reduces the impact of the reported vulnerability. If the admin action is targeted towards the attacker (e.g. the Page admin needs to co-host an event with the attacker) we deduct further.

Platform where the admin takes the actions:

Our primary concerns are with functionality that is most commonly used. Targeting smaller platforms or less common functionality may result in a deduction, e.g. an issue in m.facebook.com will generally be awarded less than its correspondent in the desktop website.
Platforms that we would deduct for include, but are not limited to, the Classic Facebook design and mobile web (m.facebook.com).

Attacker requires privileged position:

This category of vulnerabilities is generally harder to exploit if you need to be friends with the admin or have a role in the targeted group/business.
This is split into two sub-categories: high privilege (role on linked group, linked business) and low privilege (needs to be friends with the admin). High privilege scenarios will typically receive lower payouts than low privilege.

Setup factors/one-off conditions:

These represent all the specific configurations that a Page needs to be in. If more conditions are required, there will be fewer vulnerable Pages, reducing the attack surface. This deduction has less weight than an action, since requiring an admin to take an action has more friction.
Examples of these factors include: a Page having a group, inbox needs to be setup, having automatic replies, Page is part of some other group, admin is not part of the group, Page posts jobs.

Attacker requires action against the admin:

This applies when running targeted queries against the admin (e.g. the attacker needs to block admin and then admin identity gets revealed).
Admins are meant to be hidden generally, so targeting them as an attacker is difficult and heavily decreases exploitation.

Terms

An action is a user-initiated interaction or request. For example: a Page admin sharing a post; someone creating an event; commenting as a Page in a group; an admin starting a watch party.
If an interaction or condition is required only once, it is considered a setup/one-off condition and is not considered an action. For example, when a Page needs to be an admin of a group.

Missing actor indicator (where the identity under which the admin is acting is unclear) will no longer be awarded a bounty and the report will be deemed informative. There are two exceptions related to this listed below. Both will continue to be considered an issue and will be rewarded:
- Actor indicator conflicts with toast/prompt (e.g. inline selector displays Page profile, while prompt mentions that "You're now interacting as your profile") will receive a minimum bounty if the actions taken are deemed reasonable.
- Inline display is present but incorrect (e.g. the display says “Commenting as Page” but instead comments as an admin) equals $1,000* payout.

Guidelines

Payouts