The bug stems from the fact that the uploader was not protected with proper authorization, allowing unauthenticated actors to ...