Attacker can unpin posts from companies he’s not part of.