Facebook’s Graph API v1 included a feature called the “friends permission.” When a user installed an app and granted it access to their data, the app could also request access to all of that user’s friends’ data — without those friends ever being notified or consenting. The friend’s profile, location, likes, and relationship status were all accessible through the installing user’s permission grant.
In 2014, Facebook launched Graph API v2 and removed the friends permission. Apps requesting data through v2 could only access the data of users who had directly installed and consented. The fix was real — but v1 remained operational for any app that had registered before April 30, 2014.
The security fix existed — in v2. But v1 remained operational long enough for Cambridge Analytica to exploit the old permission model at scale. The vulnerability was not in any single line of code. It was in the decision to let an old API version with a worse security model keep running while a better one existed alongside it.