Disclose Instagram Personal Private Archived posts when switching to Professional account through creative hub

Introduction

Instagram features an “Archive” option, allowing users to conveniently archive their posts. According to Instagram, the content stored in the archive is intended for the user’s private viewing, ensuring that only the account holder has access to this archived material. This functionality provides users with a practical and secure way to manage and revisit their past posts without sharing them publicly.

The finding

I observed that there is a potential disclosure of old archived posts for a personal account when transitioning to a professional account using Creative Hub on Instagram

Reproduction Steps

1. Ensure that your Instagram account is initially set as a personal account.
2. Change the privacy settings of the personal account to private.
3. Create an image post and subsequently archive it, making it visible only to you.
4. Switch from the personal account to a professional account.
5. Link your Instagram account to a corresponding Facebook page.
6. Navigate to Creative Hub by visiting https://business.facebook.com/ads/adbuilder/.
7. Create a mockup and select both your linked page and Instagram account.
8. Under “Media,” add an image by selecting “Instagram images.”

Upon completing these steps, you will observe that the previously private and archived image post from when the account was personal is now visible in the Creative Hub, highlighting a potential privacy concern.

Timeline

• Sarmad: 23 Sep 2020
  • Initial Report
• Meta Bug Bounty Program: 25 Sep 2020
  • Report Triaged
• Meta Bug Bounty Program: 09 Oct 2020
  • Bounty Awarded:
• Meta Bug Bounty Program: 04 June 2021
• Bug Fixed
• Sarmad: 16 June 2021
• Fixed Confirmed

POC