Setting up tests for any App or Pixel using Facebook's Test and Learn feature

Hi,
This post is regarding one of my findings in Facebook which could have allowed anyone to set up tests for apps/pixels to which he does not have any roles/access.

Bug: Bug in Facebook's "Test And Learn" Feature which allows an attacker to set up tests for apps/pixels to which he does not have any roles/access and to view the test results.

POC Steps

Users can setup tests from the url  https://facebook.com/test-and-learn/?act=12345 where 12345 is ad account id.(Refer https://www.facebook.com/business/help/1575448755848995)
The bug was in the 2nd test option "How many conversions are all my Facebook ads causing?"
Click on "Set up Test", enter a test name and select any of your apps/pixel as the event source and select the schedule.
The API call to setup a test is like below.
"POST /v2.10/me/ad_studies?" 
There were no security checks at this end point to check whether authorized user is making the request or not.
In this request, change the value of application id/pixel id with the application id/pixel id of the victim.
Submit the request and the test will be created and status will be "planned"
Click on the test created and victim's app or pixel will be listed under measurement sources!
Now, The test will start collecting the results for the mentioned schedule for victim's app/pixel and will display the lift results and incremental efficiency associated with victim's ads.This will show how much money was spent by victim over the period and other details as well.
Just like in the below two sample figures

Mitigation and Fix

I reported this bug to Facebook on 21^st January and the report was on triage by 23^rd           
By 1^st February, Lilly from security team updated that a permanent fix was available.       
When I tried, I got below error as well.

"Application does not have the capability to make this API call" 

As this could have allowed anyone to setup tests for victim's apps/pixels, I got a nice bounty for the same!

I am thankful to the Facebook Security team for the quick fix and for the awesome bounty :)
Report timeline

21st January, 2018 - Bug Reported
23rd January, 2018 - Lilyfrom Facebook Security confirmed the bug and sent to product team.
1st February,2018 - Was Asked for the confirmation of temporary fix and I confirmed the same.
7th February,2018- Bounty awarded. 3000 USD.