In plain English
A private account blocked direct messages, but sharing a post quietly delivered one anyway.
The technical account follows below, for readers who want the detail.
Three lessons any team can use
One permission rule must cover every path that can send a message.
Mobile and web flows drift apart unless they are tested together.
Privacy settings need coverage on share and forward, not just the inbox.
The Challenge
A protected account on a global social platform cannot be messaged directly. The interface says so plainly. Yet the post sharing flow on mobile never got that memo, so forwarding a public post to the same account quietly landed a message in a conversation that should not exist.
How We Proved It
Walked the exact mobile path step by step with screenshots, proved the web flow stayed locked while mobile delivered, and proposed the one line fix that matters: enforce the same inbox permission check in the sharing flow. The report passed preliminary review, stayed alive through months of follow ups, and the behavior has since been observed fixed in the wild.
Redacted platform
Aug 19, 2026
Responsible Disclosure
Full Writeup
Researched and disclosed by Abang Obed. Read every step, payload, and takeaway.
Responsible disclosure is still in progress, so technical details stay private for now. Vetted clients can review the full account under NDA.
Ask about this workRelated Case Studies
More disclosures from our researchers.
Know your risk. Strengthen what matters.
Tell us where you are, what you rely on, and what you need to protect. We will help you understand what to do next.