“The function performs no authorization check.”
One click on a link uploaded your session files to an attacker’s channel, and that is your whole account. Telegram fixed it quietly. The 7.2.9 changelog mentions only a rendering fix. A messaging app that sells itself on security buried an account takeover under a cosmetic note.