Thanks to lukeshu for pointing a privilege scalation vector :P