User-to-Administrator escalation via mass-assigned role

Privilege escalation in Gladys Assistant before 4.45.1 allows remote authenticated users to obtain administrator access. The profile-update handler in server/api/controllers/user.controller.js passes the complete request body to the user update operation, including an attacker-controlled role field. Any ordinary account can submit an administrator role while saving a profile, gaining full control and the ability to remove the original administrator.