Telia: Location data leaked through telecom signaling

Came across an interesting telecom case in Norway recently. A mobile network was exposing cell-level location data through SIP signaling (IMS / VoLTE) during normal call setup. No exploit, no intrusion, no protocol violation — just signaling returning more context than intended. For example via headers like: P-Access-Network-Info: ... utran-cell-id-3gpp=... These values are meant to stay within trusted domains, but were visible