Redacted bugs #2: Privilege escalation using improper preservation of permissions during the OAuth app installation
