I discovered a serious vulnerability in Instagram’s Intellectual Property (IP) Reporting Center that allowed anyone to impersonate a legitimate organization or brand owner. By exploiting a synchronization flaw in the Instagram Lite app, I found a way to submit trademark and copyright reports using an unverified email address. This allowed an attacker to use an official domain (like [email protected]) to “prove” to Instagram that they represent the brand—bypassing the standard identity check and successfully removing targeted content.
What Was the Vulnerability?
The Meta IP reporting system relies heavily on the reporter’s email domain to verify their authority. Normally, if you file a report using an email like @bmw.com, Instagram’s system treats it as an official request from the brand owner. To prevent abuse, you must verify ownership of an email before using it.
However, I found that via Instagram Lite, you could link any professional email to your profile. Even if it stayed in the “Pending Verification” state, the IP Reporting Center would still use it as the official contact. This allowed me to exploit the “Domain Authority” of any company without actually owning their email server.
How to Reproduce the Issue
The vulnerability was reproducible using the Instagram Lite app on Android. Here is how the exploit worked:
- Inject the Target Domain: Using Instagram Lite, I went to Personal Information Settings and added a professional email address I didn’t own (e.g.,
[email protected]). - Bypass the Verification Lock: Even though the email was unverified and stayed in a “Pending” state, it remained linked to the account’s contact info in the backend.
- Access the IP Center: I opened the official Intellectual Property Reporting Center link: https://www.instagram.com/help/ipreporting/.
- Automatic Spoofing: On the submission page, Instagram automatically populated the “Contact Email” field with the unverified email.
- Submit as the Brand Owner: Because the email domain matched the brand being reported, the system accepted the report as coming from an authorized representative of that domain.
The Verification Scenarios:
To prove the impact, I created a “Target Account” that posted BMW logos and content to simulate a trademark violation. I then tested how Instagram would respond to two different types of reports:
Scenario 1: Using a Personal Email (The Control Test)
I submitted a trademark report against the target account using a verified personal Gmail address.
The Result: Instagram’s review team rejected the claim. They sent a response stating they could not verify my identity and asked me to contact them from an official email address representing the brand to prove I was authorized.
Scenario 2: Exploiting the Vulnerability (The Official Domain Bypass)
Using the Instagram Lite bug, I added the email [email protected] to my account and did not verify it. I then submitted the exact same trademark report against the same target account.
The Result: Within 48 hours, the IP Reporting Portal showed the report was accepted.
The Impact: The target account was immediately banned. Because the report appeared to come from a @bmw.com domain, Instagram’s team bypassed the identity check and trusted the report as a legitimate request.
Why Is This Dangerous?
- Automatic Credibility: Using an official domain acts as an “Instant Pass” for Meta’s reviewers, leading to much faster enforcement actions.
- Unverified Brand Authority: An attacker can shut down competitors or harass users by pretending to be the legal department of a major corporation.
- Weaponizing Takedowns: Since the attacker can manage the report from their own dashboard, they can carry out an entire legal claim without ever having access to the spoofed email inbox.
Resolution and Fix
After discovering the vulnerability, I reported it through Meta’s Bug Bounty Program, providing the technical details and the evidence from the two test scenarios. Meta acknowledged the issue and implemented a fix to secure the system.
Now, the fix is solid: Even if an account has a verified email, the Intellectual Property Center requires a One-Time Password (OTP) code sent to that specific email before a report can be submitted. This ensures that the person filing the report has actual, real-time access to the domain they are claiming to represent.
