@@ -1,1 +1,3 @@
+fossil user capabilities has no validation of permissions string
 
+it is possible to add multiple users with the same username, but unique uid. the command line operates on the first user but the cgi log takes the permissions of the last user.