Ruby on Rails disclosed a bug submitted by ghiculescu: https://hackerone.com/reports/1300802 [Source]