Threat actors could gain access to improperly deactivated or unmaintained Salesforce Sites by changing the host header, thereby gaining access to sensitive personal and business data.
Article Link: Inactive Salesforce Communities could leak sensitive data | SC Media