An error in the GraphQL API SQL code for todo.sr.ht and lists.sr.ht
allowed users to gain unauthorized access to privileged operations on
bug trackers and mailing lists. To correct this bug, please upgrade your
deployments to todo and lists versions 0.71.2 and 0.51.10 or newer,
respectively.

Thanks to Adnan Maolood for identifying this bug.