Dagadjno

A privilege escalation issue allows team owners to obtain administrative rights or ownership of read-only shared projects. An attacker can achieve this by creating a bot, adding it to their team, and then deleting it via the bots endpoint. This process triggers the `ensureProjectAdminUser()` function, which promotes read-only shares and locks out the actual owner.

An authentication flaw allows an attacker with a stolen session to enroll and enable Time-based One-Time Password (TOTP) authentication without providing the account password. By calling the TOTP enroll and enable endpoints with a secret of their choice, an attacker can lock the legitimate owner out of the account. This persistence remains even after the account password has been reset.