‼️ Telegram allows any user add anyone to contacts without target's control

On first screenshot you can see target's privacy settings
Then target changes phone number to attacker's prepared phone number (see screenshot 2)
And now attacker can see target's profile and share it (see screenshot 3, made from attacker's Telegram account)


Steps to reproduce:

Preparation:
— Add a phone number to your contacts (without linking an account to this number; for example, Main Phone Number)

Target's mission:
— Create an account on the Main Phone Number
OR
— Create an account on any phone number and then change it to Main Phone Number

In any case, the target's account will appear in attacker's contact list.


⚠️ Registering account or changing phone number to +888 will not save you!