When using lxdm, the X server was started without -auth, exposing it to any connections form by any local user. This update resolves the issue.
{ "section": "core" }
"https://advisories.mageia.org/MGASA-2015-0411.json"