Authenticated privilege escalation via unrestricted user updates

Improper access control in Wekan before 8.16 allows remote authenticated users to gain unauthorized organization and team access. The models/users.js Users.allow update rule accepted any field when doc._id matched userId instead of restricting changes to username and profile fields. Any authenticated account could therefore add organization or team memberships or change protected login state, exposing boards outside its authorized scope.