The finding
Across six Brazilian public-sector sites, an external user could access organizational mailboxes and read correspondence. The affected organizations included municipal administrations, education services and a fire department.
Disclosure
I reported each finding directly to the organization, explaining the exposure, its potential impact and measures to protect the affected mailboxes.
Follow on X