Description: Analytic Users are only given access to an app’s insight. In the App Ads Helper, you can check the app platform setting, mobile app install ads bid type information and a developer tools to test if a certain function of the app is working.
Proof of Concept:
Go to “https://developers.facebook.com/tools/app-ads-helper/" and select your app with an Analytic User role.
In the Ads App Helper you could:
- Check the App platform setting
- Check whether an Ad Account is eligible for bidding CPA
- Use the App Event Tester & Deep Link Tester
Impact: An analytic user can see information that shouldn’t be available to them. They could also use tools which would allow them to test certain functions of the app.
Sept. 1 2017 — Initial Report
Sept. 9 2017 — Report Triaged
Nov. 2 2017 — Advance Bounty of $500
Nov. 3 2017 — Bug Fixed