In Mahara before 20.04.5 20.10.3 21.04.2 and 21.10.0 the account associated with a web services token is vulnerable to being exploited and logged into resulting in information disclosure (at a minimum) and often escalation of privileges.