Security Bug -> User can change DB without permission