Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users.