Authenticated privilege escalation via user ID tampering

Authorization bypass in kvf-admin 1.0.0 allows remote authenticated users to modify other users' accounts through the profile update endpoint. UserController.updateInfo binds the client-supplied user.id and passes the resulting object to updateById without a permission or ownership check. Any authenticated low-privilege account can change the administrator's username, assume that account with its unchanged password, and block normal administrator login.