Account activation via nontransactional user status update

Improper access control in ToolJet before 1.19.0 allows remote authenticated users to activate invited accounts through the unarchive route. UsersService writes the requested status outside its permission-change transaction, so a later validation failure does not roll back that write. An authenticated organization-user request is required, and the demonstrated consequence is activation of an invited account despite an error response.