3 ms·
Article title downplays the important part (can read other users emails)
by intunderflow 2y ago
Article title downplays the important part (can read other users emails)
- mpschorr 2y agobut only on the r1 subdomain, which is used for sending spreadsheets to users, so all spreadsheets can be read + from a researcher in discord: “we couldve also read auth.rabbit.tech […] which is basically all rabbithole password resets, aka arbitrary account takeover including admin accounts”