An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organisation conversion feature let a personal access token (PAT) be re-assigned to a new organisation owner without rotating the secret or obtaining consent, allowing an attacker who created a throwaway account to authenticate as the target user at registry level and pull, push or delete container images.