GHSA-h5q3-fjp4-2x7r

The automated commit generated by GitHub when merging the pull request
from the security advisory's private fork was somewhat messed up (the
commit message's 1st line was changed from "Prevent unauthorized access
to other users Profiles" to "Merge commit from fork").

This somewhat artificial merge commit's purpose is to allow easy
identification of the security advisory from Git history.