At a glance

Impact
A Direct participant could delete another person's doodle for everyone in the thread.
Cause
The mutation checked thread participation but did not adequately check ownership of the selected item.
Fix / outcome
Meta triaged and awarded the report. A server-side ownership check is needed before global deletion.

Instagram Direct lets people place doodles and drag-and-drop decorations on shared messages. The UI gave another participant a local option to hide someone else's doodle. It did not offer a way to delete that item for everyone.

The backend mutation behaved differently. IGDirectSetDragAndDropItemMutation accepted a client-supplied item ID and a status of DELETED. When I supplied an item created by the other account, the server removed it globally.

Program outcome

Meta triaged the report and issued a bounty. The award amount is not included here.

Where the check stopped

The mutation appeared to verify that the requester belonged to the Direct thread. That check was not enough. It did not adequately verify that the requester owned the selected drag-and-drop item or had permission to apply a global delete state to it.

This produced a narrow but real integrity issue. Thread membership gave one participant destructive control over another participant's object.

Mutation structure

The mobile operation was IGDirectSetDragAndDropItemMutation. The underlying mutation was xig_direct_set_drag_and_drop_item.

I tested through Instagram Android app traffic on an Android 14 AVD, with Windows as the host system. No browser was involved.

Relevant mutation input 
{
  "dropped_item_id": "<item_created_by_other_participant>",
  "dropped_item_status": "DELETED"
}

The item ID came from reactions.drag_and_drop[0].dropped_item_id in the controlled thread response. Authentication headers, session values, device identifiers, and account information are omitted.

Reproduction

I used two Instagram accounts I controlled in a one-to-one Direct thread.

  1. Account B added a doodle or drag-and-drop item to a shared message.
  2. Account A read B's dropped_item_id from the thread response.
  3. From A's authenticated Android session, I sent IGDirectSetDragAndDropItemMutation with B's item ID.
  4. I set dropped_item_status to DELETED.
  5. I reopened the thread as Account B.
  6. B's doodle had disappeared from the shared message.

The deletion was server-side. It became visible to the creator immediately and was not limited to Account A's local view.

Expected and actual behavior

Expected

A participant who does not own a doodle should be limited to the UI's local hide behavior. A global delete should require ownership or another explicit permission.

Actual

Any tested participant in the thread could submit the owner's dropped_item_id with the DELETED state. The backend accepted it and removed the item for everyone.

Impact and scope

The issue allowed unauthorized modification of shared message state. It did not expose message contents or give access to threads outside the attacker's membership. The affected boundary was ownership inside an existing thread.

Testing stayed inside a conversation between two accounts I controlled. I did not target unrelated users or threads.

Meta timeline

  • 18 June 2026, 10:35 PM: report submitted
  • 22 July 2026, 9:47 AM: report triaged
  • 5 August 2026, 12:13 PM: bounty paid

The server-side fix is to bind the requested item to its creator and allowed actions before changing its shared state. Knowing the item ID and sharing the thread should not be enough to delete it globally.