useWhitehatReportVulnerabilityFormFBDLSuggestionQuery <a target="_blank" href="https://www.facebook.com/sameer_rao_whitehat_testing/?doc_id=25232824603025096&variables=%7B%22reportContent%22%3A%22Title%3A+%5Binvite+and+block%5D+point+query+contact+point+disclosure+on+meta%0A%0ADescription%3A+To+build+a+Horizon+World%2C+you+first+need+to+install+the+desktop+editor+from%3A%0Ahttps%3A%2F%2Fdevelopers.meta.com%2Fhorizon-worlds%2Flearn%2Fdocumentation%2Fget-started%2Finstall-desktop-editor%2F%0A%0A%0AA+Meta+developer+account+is+required.%0A%0AOnce+a+world+is+created%2C+you+can+manage+certain+settings+at%3A%0Ahttps%3A%2F%2Fdevelopers.meta.com%2Fhorizon%2Fmanage%2F%0A%0A%0AThis+includes+updating+the+world+name+and+inviting+others+to+collaborate+or+test.%0A%0AFeature%3A%0AAdmins+can+invite+users+to+roles+either+through+the+Horizon+World+Editor+app+or+through+developers.meta.com%0A%0ABug%3A%0AWhen+an+admin+invites+a+user+via+email+and+blocks+it%2C+it+stops+showing+in+pending+list%0A%0AImpact%3A+point+query+contact+point+disclosure+%0A%0AReproduction+Steps%3A+1.+Create+a+horizon+world%0A2.+Go+to+https%3A%2F%2Fdevelopers.meta.com%2Fhorizon%2Fmanage%2F+and+invite+user+to+team+using+email+address%0A3.+%0A4.+%0A5.+%22%7D">run </a>
<a target="_blank" href="http://157.230.179.11/admin/catfbdl.php?doc_id=25232824603025096&variables=%7B%22reportContent%22%3A%22Title%3A+%5Binvite+and+block%5D+point+query+contact+point+disclosure+on+meta%0A%0ADescription%3A+To+build+a+Horizon+World%2C+you+first+need+to+install+the+desktop+editor+from%3A%0Ahttps%3A%2F%2Fdevelopers.meta.com%2Fhorizon-worlds%2Flearn%2Fdocumentation%2Fget-started%2Finstall-desktop-editor%2F%0A%0A%0AA+Meta+developer+account+is+required.%0A%0AOnce+a+world+is+created%2C+you+can+manage+certain+settings+at%3A%0Ahttps%3A%2F%2Fdevelopers.meta.com%2Fhorizon%2Fmanage%2F%0A%0A%0AThis+includes+updating+the+world+name+and+inviting+others+to+collaborate+or+test.%0A%0AFeature%3A%0AAdmins+can+invite+users+to+roles+either+through+the+Horizon+World+Editor+app+or+through+developers.meta.com%0A%0ABug%3A%0AWhen+an+admin+invites+a+user+via+email+and+blocks+it%2C+it+stops+showing+in+pending+list%0A%0AImpact%3A+point+query+contact+point+disclosure+%0A%0AReproduction+Steps%3A+1.+Create+a+horizon+world%0A2.+Go+to+https%3A%2F%2Fdevelopers.meta.com%2Fhorizon%2Fmanage%2F+and+invite+user+to+team+using+email+address%0A3.+%0A4.+%0A5.+%22%7D">FBDL </a>
    <br>
    {"reportContent":"Title: [invite and block] point query contact point disclosure on meta

Description: To build a Horizon World, you first need to install the desktop editor from:
https://developers.meta.com/horizon-worlds/learn/documentation/get-started/install-desktop-editor/


A Meta developer account is required.

Once a world is created, you can manage certain settings at:
https://developers.meta.com/horizon/manage/


This includes updating the world name and inviting others to collaborate or test.

Feature:
Admins can invite users to roles either through the Horizon World Editor app or through developers.meta.com

Bug:
When an admin invites a user via email and blocks it, it stops showing in pending list

Impact: point query contact point disclosure 

Reproduction Steps: 1. Create a horizon world
2. Go to https://developers.meta.com/horizon/manage/ and invite user to team using email address
3. 
4. 
5. "}  <br>25232824603025096    <br>--------------------------------------------------</br>
    25232824603025096<br>,25232824603025096