Private Instagram Photos Exposed to Strangers in Silent Privacy Flaw

Researcher Reveals Server-Side Bug That Leaked Photo Links from Private Profiles

A security researcher has disclosed evidence showing that some Instagram private profiles were unintentionally exposing links to user photos to unauthenticated visitors, raising serious concerns about platform-level privacy enforcement.

Although Instagram’s private account feature is designed to restrict photos, videos, reels, and stories to approved followers only, the researcher found that private content was embedded in server responses, making it accessible without logging in under specific conditions.

What Was Exposed

According to security researcher Jatin Banga, when certain private Instagram profiles were accessed by unauthenticated users—particularly from specific mobile user agents—the platform returned hidden links to private photos and captions inside the page’s HTML source code.

While visitors still saw the standard message:

“This account is private. Follow to see their photos and videos.”

…the backend response included encoded CDN URLs pointing directly to images that should have remained inaccessible.

How the Leak Worked

The vulnerability involved a backend response object that contained:

• Direct links to private photos
• Captions associated with those images
• Embedded JSON objects not filtered by authorization checks

Banga demonstrated that authorization was not properly enforced server-side, contradicting Meta’s initial explanation that the issue was related to CDN caching.

In controlled testing, around 28% of private test accounts returned private photo data under the affected conditions.

Disclosure Timeline and Response

• October 12, 2025: The issue was reported to Meta
• Meta initially classified it as a CDN caching issue
• The researcher disputed this, identifying it as a server-side authorization failure
• The issue stopped reproducing around October 16, suggesting a silent fix
• Despite this, Meta later closed the report as “not applicable”, citing non-reproducibility

The researcher waited over 100 days—exceeding standard coordinated disclosure timelines—before publishing the findings publicly.

Why the Issue Is Concerning

• The fix was applied without acknowledgment
• No public explanation or root-cause analysis was provided
• It’s unclear how long private data may have been exposed
• Users were never notified of potential privacy impact

Banga emphasized that the disclosure was made without seeking a bounty, stating that transparency and accountability were the primary motivations.

Why Evidence Couldn’t Be Archived Publicly

The researcher explained that public archiving tools like the Wayback Machine could not capture the issue because:

• The vulnerability only triggered with specific mobile headers
• Archiving crawlers did not use the required request format

This limitation made third-party verification more difficult, despite extensive logs and recorded proof-of-concept demonstrations.

Meta’s Position

Meta did not respond to multiple requests for comment before publication. In internal correspondence shared by the researcher, a Meta analyst acknowledged that an issue could have been fixed as an “unintended side effect” of another change, without confirming the vulnerability itself.

Why This Matters

Even short-lived authorization failures can have long-term privacy implications, especially on platforms where users rely on private account settings to control visibility.

This case highlights ongoing challenges in:

• Backend authorization enforcement
• Transparency in vulnerability handling
• Trust between platforms and security researchers