Security issue: User not authenticated properly! User can change other user's info.

[symos]

When someone makes a POST request to the "/vsbridge/user/me" API, the system checks if the user is authenticated (via the firewall), but then proceeds to edit the user whose email the requester provided, not necessarily the user who is making the request!

So, as long as the user making the request is a customer, they can edit any other customer's details!