Exactly, that in itself is the whole point of this being a security bug.