#SecurityAdvisory
Verified with @hexuniverse and @tlgrmHK, the (Unofficial) Telegram Support Group of Hong Kong confirms that the internal Telegram "add contact" feature is leaking phone number of the account.
When users adds the desired contact, regardless how the account setting was, or explicitly disabled the sharing of account phone number, the bug still shares the phone number to the new contact.
It is notable that this feature is irrelevant to any other options related to the phone or computer permissions, meaning no matter you grant "Contact"/"Phonebook" permission or not, the app will still share your phone number to the new contact.
Currently @hexuniverse has informed the Telegram officials about the security incident, yet no replies or follow-up occured in the meantime.
The (Unofficial) Telegram Support Group of Hong Kong hereby to advise Telegram users not to use such feature, and avoid using any contact-related features until the bug get fixed.
=======================
@hexuniverse is the development team and channel for @hexlightning_bot, dedicated themselves in protecting the Telegram ecosystem and fight spamming in Taiwan and Hong Kong region. You may donate to them using the link at the bottom of this message: https://t.me/hexuniverse/87
Verified with @hexuniverse and @tlgrmHK, the (Unofficial) Telegram Support Group of Hong Kong confirms that the internal Telegram "add contact" feature is leaking phone number of the account.
When users adds the desired contact, regardless how the account setting was, or explicitly disabled the sharing of account phone number, the bug still shares the phone number to the new contact.
It is notable that this feature is irrelevant to any other options related to the phone or computer permissions, meaning no matter you grant "Contact"/"Phonebook" permission or not, the app will still share your phone number to the new contact.
Currently @hexuniverse has informed the Telegram officials about the security incident, yet no replies or follow-up occured in the meantime.
The (Unofficial) Telegram Support Group of Hong Kong hereby to advise Telegram users not to use such feature, and avoid using any contact-related features until the bug get fixed.
=======================
@hexuniverse is the development team and channel for @hexlightning_bot, dedicated themselves in protecting the Telegram ecosystem and fight spamming in Taiwan and Hong Kong region. You may donate to them using the link at the bottom of this message: https://t.me/hexuniverse/87