Privilege escalation via unchecked handle dispatch

Improper authorization in the BulkActions dispatcher in Akaunting 3.1.21 allows remote authenticated users to escalate privileges via crafted bulk-action requests. The common bulk action endpoint reads a request-controlled handle, checks permissions only when that handle matches a direct key in the $actions metadata array, and then invokes the same handle as a method on the resolved bulk-action class. An authenticated Manager with read-admin-panel access but without auth-users permissions can send direct POST requests to update roles, promote an account to Admin, or delete other users.