How I could have hacked Facebook Analytics to view any Facebook page's Analytics- $7500

Hi,
This post is regarding one of my findings in Facebook which could have allowed anyone to view the Facebook Analytics of any Facebook page without having any roles on the page.

Bug:  Bug in Facebook Analytics which allows an attacker to view analytics of any Facebook page without having any roles on the page.

POC Steps

The API call to create an event source group is like below.
"GET /v2.10/1234/event_source_groups?" 
where "1234" is the business account id and it accepts the parameters, name and event_sources .
The parameter event_sources can contain the id of page,app,pixel or offline event set.
After some testing, I found that while adding a page object as an event source, there are no security checks at this end point to check whether authorized user is making the request or not.
In addition to this, I found other two end points as well which is vulnerable.

1)While making a POST request to an existing event source group.
2)At the "external_event_sources" edge  in a Product Catalog.

This allowed me to add victim's page(in which I do not have any roles/access) as an event source to the new event source group.
The response was like below.
/**/ __globalCallbacks.f1282beea9a7e38({"id":"99999"}); 
Where 99999 is the id  of the new event source group created.
I was curious to see whether this event source group was listing victim's page or not!
I opened the link "https://facebook.com/analytics/99999 " and clicked on Settings. 
Confirming my guess, I saw the victim's page listed there.

I just clicked on the page and it opened the Analytics of Victim's Page
Ie, I got complete access to the analytics of victim's page in which I do not have any roles :)
I was able to view all the details, create dashboards, and do all other activities here.

Mitigation and Fix

I reported this bug to Facebook on October 16th. Initially it took time to get the 1st update and and got it on 22nd.
Within 30 minutes after the acknowledgment, Facebook removed Event Source Group Creation as a temporary fix showing the criticality of the bug.
Also the security team member Mesut asked me to confirm the temporary fix.

When I tried through API call, got below error as well.

"/**/ __globalCallbacks.f33f5867ddcb64c({"error":{"message":"(#2) Service temporarily unavailable","type":"OAuthException","is_transient":true,"code":2,"fbtrace_id":"C\/kcS9baO6b"}});"
After few days, I checked again and saw a permanent fix. All the endpoints now returns the below response for unauthorized calls.
"
/**/ __globalCallbacks.f35ce9b15337664({"error":{"message":"(#10) Error creating event source group. Verify that you have permissions on all event sources.","type":"OAuthException","code":10,"fbtrace_id":"Dr6Dam4AIJ5"}});"
As this could have allowed anyone to view the Analytics of any Facebook page without any special permissions, I got a nice bounty for the same.

I am thankful to the Facebook Security team for the quick fix and for the awesome bounty :)
Report timeline

16th October, 2017 - Bug Reported
22nd October, 2017 - Mesut from Facebook Security confirmed the bug and sent to product team.
22nd October, 2017 - Asked for the confirmation of temporary fix and I confirmed the same.
28th October, 2017 - Confirmation of the permanent fix by me.
1st November, 2017 - Bounty awarded. 7500 USD.