Comment by XCabbage
4 months ago
Unauthorized read access to private emails you were never legitimately CCed on already is impact. It should not be necessary to come up with a further exploit daisy chained on top of that in order to be taken seriously. (Otherwise why stop at Slack access? Why is that automatically "impact" if email access isn't?)
Exactly.
It's possible that some chains could have credentials or other sensitive information in ticket chains.