Security flaw—or just not supposed to have been discovered by the public?
Bingo.
It's not a bug; it's a feature.