Instagram Private Profiles Expose User Photos to Unauthenticated Visitors

Security researcher Jatin Banga discovered that certain private Instagram profiles were leaking links to private photos in their HTML responses. This vulnerability allowed unauthenticated users to access content that should have been restricted to approved followers. The issue was reported to Meta on October 12, 2025, and Banga found that at least 28% of the tested private accounts returned captions and links to private photos.

Despite the vulnerability being fixed within a few days, Meta closed the case as ‘not applicable,’ stating that the issue could not be reproduced. Banga contested this classification, arguing that the problem stemmed from a server-side authorization failure rather than a CDN caching issue. He expressed concerns about the lack of acknowledgment from Meta regarding the severity of the vulnerability.

Banga’s findings highlight significant privacy risks for Instagram users, as the potential for unauthorized access to private content raises questions about the effectiveness of the platform’s security measures. The researcher noted that the exploit ceased functioning around October 16, 2025, but without a detailed analysis from Meta, it remains unclear if the underlying issue has been fully resolved.

Implications for Users

This incident underscores the importance of understanding privacy settings on social media platforms. Users should be aware that even private accounts may not be entirely secure if vulnerabilities exist in the platform’s infrastructure. Regularly reviewing privacy settings and being cautious about the information shared online can help mitigate risks.

Organizations using social media for communication should also consider the implications of such vulnerabilities. Ensuring that employees are trained on privacy best practices and the potential risks associated with social media can help protect sensitive information.

In light of this incident, users should remain vigilant and monitor their accounts for any unusual activity. Being proactive about privacy and security can help safeguard personal information from potential leaks.

• Jatin Banga: The security researcher who discovered the vulnerability in Instagram’s private profiles.
• Meta: The parent company of Instagram, which addressed the vulnerability after being notified.
• Private Instagram Profiles: Accounts designed to restrict access to approved followers, which were found to leak content.
• HTML Response: The format in which the leaked links to private photos were embedded, allowing unauthorized access.
• Server-Side Authorization Failure: The technical issue that allowed the leak to occur, as identified by Banga.