HackerOne disclosed a bug submitted by madara_: https://hackerone.com/reports/2301565 – Bounty: $2500 [Source]