Harvard had a similar bug - you could modify the url to find out if you had entry. They found out and revoked admission from all students who used the url on ethics violations.
The HBS folks incorrectly thought that their work in the system was private.
TBH, they should be mad at the company and mad at themselves for not engaging in due diligence. That said, I can see how this would be an ethical violation, akin to asking a friend who works in the admissions department for an update.
It isn't, Harvard is just virtue signaling. Their admissions have always been fucked up. This is the same university that treats Asians as third-class candidates and openly defies the Supreme Court rulings on affirmative action.
