Don't have Telegram yet? Try it now!
https://footstep.ninja/posts/exploiting-self-xss/
I just read "Exploiting a Self Stored XSS with an IDOR"