Account takeover via caller-selected user update

Improper privilege management in Trudesk before 1.2.4 allows remote authenticated users to modify other users' accounts through its API. The /api/v1/users/{username} path accepts a caller-selected account and privileged password, role, and group fields, while the fixed profile handler binds the username to the authenticated account and excludes role and group changes. Any valid user access token reaches the affected operation, enabling account takeover or assignment of administrative privileges.