Threats affecting pkg:github/photoprism

PhotoPrism versions before 260601-a7d098548 contain an access control vulnerability allowing authenticated non-admin users to modify other users' profile information. This occurs due to missing session-to-user identifier validation in the PUT users API endpoint, enabling unauthorized profile overwrites.