Privilege escalation vulnerability

Summary

Normally a full-access administrator of a shop (other than the account owner) should not be able to see the account owner's user profile. But a missing authorization check allowed the account owner's profile to be viewed if requested directly by URL.