Security fixes
- Admin payments API updates transaction details for arbitrary reservation IDs across organizations due to a missing reservation ownership check - reported by @hongshengy
- Cross-Organisation Sponsor Scan via Missing Organisation Ownership Check - reported by @Et43 - CVE Pending
- Bypass Current Password Requirement for Password Change - reported by @Et43 and @DevNoScope - CVE-2026-77370
- Bulk sponsor-scan endpoint lacks role restriction - reported by @Fewword - CVE-2026-70661
- Promo code update authorizes body scope but mutates path target - reported by @Fewword - CVE-2026-70662
- Legacy configuration endpoints accept unsupported keys at lower scopes - reported by @Fewword - CVE Pending
- API key role assignment not constrained to API-key roles - reported by @Fewword - CVE-2026-70663
- SSRF with data exfiltration via unvalidated imageUrl in Admin Event/Subscription API - reported by @iaohkut-from-NightWolf-Team - CVE-2026-70664
Fixed bugs
- fix: make sure that the locking order is consistent between operations by @cbellone in #1525
- "Compose Message" does not send message to multiple ticket holders - reported by @NoUseForUsernames
- set title server side in the index.html template by @syjer in #1534
Full Changelog: 2.0-M5-2606...2.0-M5-2609