Reflex vulnerable to private state fields modification

Summary

A user on the website can modify any private field on their own state.

Details

An event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields.

Impact

If one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.