Lark Technologies disclosed a bug submitted by kongwenbin: https://hackerone.com/reports/1948506 [Source]