Leaking of page store details via downloaded location data from Business Locations

Hi,
This post is regarding one of my findings in Facebook which could have allowed anyone to  access details of a page's stores by exporting a CSV.

Bug: Leaking of page store details via downloaded location data from Business Locations
POC Steps

Page Admins can download locations data from Business Locations using the link "https://business.facebook.com/ajax/editpagesx/export_children.php?id=12345&intern_tool=false" where 12345 is the page id.
This will allow them to download and view the location pages and their data connected to the main page.
Security checks were missing at this ajax endpoint which allowed me to download the locations data for any Facebook page by replacing the value of "id" parameter with victim's page id.
There were some sensitive data like Franchise, Store Number, Store Visits Measurement,Network Access Type, Location Descriptor etc  in the downloaded excel file which should be accessible only to the page admins. These details were exposed to anyone who exploits this bug.

Mitigation and Fix

Reported the bug on 11th February and  was asked about the impact of the bug after few days.
I replied mentioning that store details being exposed to arbitrary users.
The bug has been completely patched now and the endpoint returns the below error now.

for (;;);{"__ar":1,"error":1357031,"errorSummary":"This content is no longer available","errorDescription":"The content you requested cannot be displayed at the moment. It may be temporarily unavailable, the link you clicked on may have expired or you may not have permission to view this page.","payload":null,"bootloadable":{},"ixData":{},"gkxData":{},"lid":"6528771232389026446"}

I got a nice bounty for the same!

I am thankful to the Facebook Security team for understanding the impact of the bug and for the awesome bounty :)
Report timeline

11th February, 2018 - Bug Reported
16th February, 2018 - Was asked for more details and provided the same.
21st February, 2018 - Report was on triage.
6th  March, 2018 - Bug was fixed.
14th  March, 2018- Bounty awarded. 500 USD.