Pranav Hivarekar, a security researcher from India, discovered a critical vulnerability in Facebook's platform that allowed him to delete any video he wanted.
The problem was with a new Facebook feature added to the service earlier this month, when the social network allowed the posting of videos and comments on other posts. 
The researcher reports that by tinkering with certain Facebook API requests, he was able to delete any video uploaded to the platform, based on its ID.
“This error is proof that the logic is wrong and it is not some technical flaw that we see like RCE, SSRF, etc.,” the researcher explains.
The issue, according to Hivarekar, is created when a user uploads a video as a comment. The video is uploaded to their Facebook profile, and that gives it a specific ID. Then after posting in the desired location, that ID is there.
In his tests, the researcher discovered that he could create comments via Facebook's API, could then send another API request to attach any video ID from any user to their comment. Of course, after all this, using another API request, he could delete the comment.
Hivarekar said Facebook developers forgot to add checks to prevent videos from being deleted by people who didn't upload them.
The researcher reported the vulnerability to Facebook through its bug bounty program on June 11, two days after the social network released the new feature.
Facebook, on the other hand, released a temporary fix after 23 minutes, and then fixed the bug completely 11 hours later. For the extremely critical bug that the researcher reported to Facebook, the social network rewarded him with a five-figure reward.
