Privilege escalation via unchecked privilege update

Missing authorization in Putong OJ before 2.1.0-beta.1 allows remote authenticated users to elevate their accounts to root privilege. The user update controller assigned an attacker-supplied privilege value without verifying that the session belonged to a root user. An ordinary user session is sufficient to obtain admin-level operations and unauthorized access to sensitive data.