Page admin and email disclosure

The AdsLeadGenLeadRetrievalEmailModalContainerQuery GraphQL query has a field page_admins_with_manage_leads_access with no access control on it, leading to disclosure of a Facebook page admin as well as their personal email address. 1. Login to facebook.com as Attacker 2. Open Chrome Developer Tools and insert the following script for a GraphQL query require("AsyncRequest"); new…