Reading the code changes, the vulnerability is “any logged-in user can trivially (no coding even required – a beginner armed with a simple web browser extension can do it in a few seconds) change his logged-in user ID to that of any other user, i.e. can log in as any other user (including admins)”.