Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
- https://hackerone.com/reports/673724
No PoCs found on GitHub currently.