[GHSA] GHSA-mpmw-f6h6-3g26 (medium) — Winter: My Account preview exposes another backend user's profile by record ID

GHSA-mpmw-f6h6-3g26 Severity: medium CVE: None

Winter: My Account preview exposes another backend user's profile by record ID

### Impact

`Backend\Controllers\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so that any authenticated backend user can manage their own account. It implements the `FormController` behavior, which exposes three routable actions — `cre