GHSA-rfgh-63mg-8pwm — pyload-ng WebUI JSON permission mismatch lets ADD and DELETE users invoke MODIFY-only actions

Authenticated low-privileged users can perform actions through pyLoad WebUI JSON endpoints that pyLoad’s permission model designates as requiring MODIFY permission.