Project Admin escalation via insufficient reparenting authorization

Improper privilege management in Vikunja before 2.3.0 allows remote authenticated users with inherited Write access to gain project Admin access. The CanUpdate check accepts Write permission on a new parent_project_id, while a recursive CTE then inherits the attacker-owned parent's Admin level on the moved project. Write access to a shared project is sufficient to delete it, alter sharing, or remove other users' access after reparenting.