[BAC] Improper Authorization in Public Facebook Groups

While testing access control mechanisms in Facebook Groups, I started with a simple assumption: each role should have clearly defined…