CVE-2026-54050

### Summary The Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different `userId` in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks. ### Details `ProfileController.removeProfileImage()` in the webapi module retrieves the current user's session but performs no comparison between the authenticated user and the target `userId` path parameter: ```java @DeleteMapping(value = "/users/{userId}/profile/image") public ResponseEntity<String> removeProfileImage(@PathVariable String userId) { String currentUserId = checkSakaiSession().getUserId(); if (currentUserId == null) { return ResponseEntity.status(HttpStatus.FORBIDDEN).build(); } profileService.removeProfileImage(userId); // userId is attacker-controlled return ResponseEntity.ok().build(); } ``` `ProfileServiceImpl.removeProfileImage()` delegates directly to `dao.removeProfileImage(userUuid)` with no authorization check. The DAO calls `profileImageUploadedRepository.deleteById(userId)`, removing the `profile_images_t` row unconditionally. For contrast, the upload endpoint `setProfileImage()` correctly verifies ownership: ```java if (!sakaiProxy.isSuperUser() && !StringUtils.equals(currentUserUuid, userUuid)) { throw new SecurityException("Not allowed to save."); } ``` This asymmetry means any authenticated user can delete but not upload over another user's profile image. Additionally, the pronunciation recording delete endpoint (`DELETE /api/users/{userId}/profile/pronunciation`) has no `checkSakaiSession()` call at all, making it accessible without any authentication. **Setup:** - Admin user: `admin`, with a custom profile im