Since this is a security bug, marking major; I *think* this is the right thing, but since the definitions of severity/priority are unlinked, I can't know for sure.
Since this is a security bug, marking major; I *think* this is the right thing, but since the definitions of severity/priority are unlinked, I can't know for sure.