Facebook IDOR bug in GraphQL

Acknowledged by "FaceBook" Security Team
Today in Amman, Jordan

Got acknowledged by Facebook Security Team After discovering a security issues in a "portal" store "https://portal.facebook.com" A store dedicated to the sale of "Portal and Portal+" devices provided by Facebook recently.
The vulnerability type "IDOR": allows any potential attacker to change the account settings for another user

حصلت على أعتراف من الفريق الامني في شركه فيسبوك بعد أبلاغي عن خلل أمني متجر https://portal.facebook.com المخصص لبيع أجهزة الاتصال portal & portal+ التي وفرتها فيسبوك مؤخرا.
نوع الثغره "IDOR" تسمح لأي مهاجم محتمل بتغير اعدادت الحساب لاي مستخدم اخر على خدمة https://portal.facebook.com

PoC : https://youtu.be/lY_5FHhRVko

HOF : https://web.facebook.com/whitehat/thanks/

Timeline:
10/10/2018 Me, Submitted Report
15/10/2018 FB, Need More Info and Sent a reply
18/10/2018 FB, Need More Info and Sent a reply
22/10/2018 FB, Reproduce my report
25/10/2018 FB, Report Triaged
07/11/2018 Me, Ask any update?
14/12/2018 Me, Ask Any Update?
25/01/2019 Me, Ask Any Update?
26/02/2019 Me, Ask Any Update?
26/02/2019 FB, Apologize to daley!!
01/03/2019 Me, ask any update?
15/04/2019 Me, ask any update?
15/04/2019 FB, Issue Fixed and confirm
29/04/2019 FB, bounty awrded