The vulnerability, uncovered during a penetration testing exercise, hinges on misconfigurations within Salesforce Communities.