Comment by bawolff

> After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained

Ignoring the legalities of it all, this step crosses a line morally imo.