Meta Restores Muse Sharing Feature After Addressing URL Privacy Issue

Image: Meta turns Muse sharing back on · Source

Meta has reactivated sharing for its Muse collaboration tool after fixing a vulnerability that exposed public links to sensitive content. The company updated URLs and notified users of changes to enhance data protection.

Meta recently re-enabled the sharing feature in its collaboration tool, Muse, following reports from security researchers who found that shared conversation links were easily discoverable publicly. The vulnerability potentially exposed sensitive Muse pages, including internal documents such as a marketing company’s revenue review and a small business owner’s loan application, raising privacy concerns. Researchers at Claroc highlighted that Muse’s public URLs were derived from conversation titles and were stored in public DNS, making them prone to being found without authorization. Upon learning of this issue, Meta promptly paused the sharing functionality to investigate and address the problem. David Singleton from Meta explained via a post on X that the root cause lay in the URLs of shared Muse artifacts—such as documents and images attached within Muse—and clarified that the chat sharing aspects were not affected. To mitigate the risk, Meta has replaced the URLs for any artifacts shared before the fix; users who try to access an old link will see a notice directing them to request the updated link from the sharer. Singleton acknowledged the inconvenience caused by this transition but emphasized that protecting user data is the top priority for Meta. With the fixes implemented, Muse’s sharing feature has resumed, balancing user collaboration needs with stronger privacy safeguards.