Programmer, web developer and bug bounty hunter Roy Castillo discovered a glitch in Facebook late last month that will expose any email address without user interaction – and despite the privacy setting.
.jpg&h=420&w=748&c=0&s=0)
The flaw resided in Facebook's app development tools which allowed app administrators have the ability to add information for developers. In this instance, the primary email address for any unverified Facebook user would be revealed if added as a developer.
Numerical Facebook user IDs could be collected through Facebook's People Directory and dumped into the developer profile page to generate an error message containing the users' primary email address, regardless of their privacy settings.
Castillo was able to reproduce the result by simply blocking an account, and then by adding more parameters, obtaining a list containing multiple email addresses at once.
He discovered the vulnerability on 25 June and was paid $4500. The flaw was fixed in six hours.
.png&h=140&w=231&c=1&s=0)
_page-0001.jpg&w=100&c=1&s=0)
.png&w=120&c=1&s=0)
Security Exhibition & Conference 2025
Integrate Expo 2025
Digital Leadership Day Queensland
Government Innovation Showcase Queensland
Government Cyber Security Showcase Queensland
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
