GHSA-9rj9-5wcv-xgf2 Roundup Improper Access Control

• PyPI Roundup: >= 1.2, < 1.2.1 → fixed in 1.2.1 • PyPI Roundup: >= 1.4, < 1.4.7 → fixed in 1.4.7

The EditCSVAction function in `cgi/actions.py` in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.