EIP-2026-104912

The advisory describes an authorization flaw in Achievo 1.4.3, allowing arbitrary activity creation and deletion by manipulating user IDs in POST requests. No exploit code is provided, only a proof-of-concept description.