The vulnerability was identified earlier this week by researchers at Claroc, who found that web addresses for shared conversations were predictable and easily discoverable. Following an inquiry from Ars Technica, Meta paused the tool to prevent further data exposure. David Singleton, a representative for Meta, confirmed today that the issue stemmed from how URLs were generated for shared artifacts—such as documents and images—rather than the chat-sharing functionality itself.
Meta Restores Muse Sharing After Privacy Vulnerability
Security researchers discovered that shared links to Meta’s Muse platform were inadvertently leaking sensitive information, including internal revenue reviews and loan applications, by exposing conversation titles directly within public DNS records. The discovery prompted a temporary suspension of the sharing feature while engineers overhauled the underlying URL generation process.
To mitigate the risk of unauthorized access, the company has implemented a mandatory link rotation. Any artifact shared prior to the fix now requires a new URL, rendering old links inactive. Users attempting to access previous shares will instead encounter a notice prompting them to request a fresh, secure link from the original owner. While acknowledging the inconvenience, Meta stated that the disruption was a necessary trade-off to prioritize user data protection.
Comments (0)
No comments yet. Be the first!