Meta has re-enabled the sharing feature for Muse following a security vulnerability that allowed public access to private conversation links. The social media company had previously paused the functionality after security researchers identified that public links were easily discoverable.
Researchers at Claroc discovered that Muse web addresses were constructed using conversation titles and recorded in public DNS records. The security team found a marketing firm's internal revenue review and a small business owner's loan application through these exposed links.
David Singleton stated that the underlying issue is now fixed, and sharing is back on. Singleton explained that the problem involved URLs for shared Muse artifacts, which include items such as images and documents within the platform.
The company clarified that the vulnerability did not stem from a flaw in the chat sharing mechanism itself. Users who shared an artifact before the repair now have a new URL for that content.
Singleton noted that anyone attempting to visit an old link will see a message requesting they obtain the updated link from the owner. Singleton said, "We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first."
