> A year ago I reported a security issue in Mozilla Basket (not publicly accessible). The essence is that subscribing anybody to Mozilla’s newsletters is trivial

I don’t see how signing someone up to a newsletter is a security vulnerability.