Will do! I do feel a bit sore having discovered this earlier for a client who agreed it was okay to disclose after they fixed the issue internally (which they just did). This is the reason for the other CVE-placeholder below which was created after this PoC was drafted last august.