GHSA-hm2h-wwwh-g49x: Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

The PUT /user endpoint is protected by RequireScopes("profile:read"), which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin’s restricted profile:read access token can change the admin’s password, then login to receive an unrestricted session token that bypasses all scope enforcement.