DESIGN FLAW IN GOOGLE WORKSPACE COULD LET ATTACKERS GAIN UNAUTHORIZED ACCESS

Summary from the TLDR InfoSec newsletter

Google Workspace's domain-wide delegation feature has a severe design flaw dubbed DeleFriend that enables privilege escalation without admin access. Attackers could gain unauthorized Workspace API access for theft, exfiltration, and other unauthorized actions domain-wide. Successful exploitation of the flaw could allow exfiltration of sensitive data from Google services like Gmail, Drive, Calendar, and others.