GHSA-h4hf-v6w5-897x: Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

The REST API user-update endpoint (PUT/PATCH /api/v2/users/{id} and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the user_edit_others permission but is not a superuser can:

1. edit user accounts that belong to a superuser, and
2. set the password of any account, even without the user_passwd_edit_others permission.

Because of this, a non-admin “user manager” role can send a single API request that changes the administrator’s password, then log in as the administrator. This is a full privilege escalation and account takeover. The same actions are explicitly blocked in the web UI, so the API is inconsistent with the application’s own permission model.