Attacker can Add itself as admin user and can also change privileges of Existing Users []

U.S. Dept Of Defense disclosed a bug submitted by dishant_singh: https://hackerone.com/reports/2354136