> Curry says a vulnerability in the Javascript of the website let the team change an account type from a regular user to an administrator

...