Security News > 2021 > June > Instagram Bug Allowed Anyone to View Private Accounts Without Following Them
Instagram has patched a new flaw that allowed anyone to view archived posts and stories posted by private accounts without having to follow them.
"This bug could have allowed a malicious user to view targeted media on Instagram," security researcher Mayur Fartade said in a Medium post today.
"An attacker could have been able to see details of private/archived posts, stories, reels, IGTV without following the user using Media ID.".
Fartade disclosed the issue to Facebook's security team on April 16, 2021, following which the shortcoming was patched on June 15.
Although the attack requires knowing the media ID associated with an image, video, or album, by brute-forcing the identifiers, Fartade demonstrated that it was possible to craft a POST request to a GraphQL endpoint and retrieve sensitive data.
Uri corresponding to the media ID could be extracted even without following the targeted user, alongside exposing the Facebook Page linked to an Instagram account.