GHSA-h4hf-v6w5-897x

### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the `user_edit_others` permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2. set the password of any account, even without the `user_passwd_edit_others` permission. Because of this, a non-admin "user manager" role can send a single API request that changes the administrator's password, then log in as the administrator. This is a full privilege escalation and account takeover. The same actions are explicitly blocked in the web UI, so the API is inconsistent with the application's own permission model. ### Details Poweradmin's permission model treats these as three distinct permissions: - `user_edit_others` (id 57): "User is allowed to edit other users." - `user_passwd_edit_others` (id 58): "User is allowed to edit the password of other users." - `user_is_ueberuser` (id 53): full admin. The existence of a separate `user_passwd_edit_others` permission means that "edit other users" is not supposed to include changing their passwords. The web UI enforces this, and it additionally forbids any non-superuser from editing a superuser account at all. The API skips both rules. **Where the API is missing the superuser check.** `lib/Domain/Service/ApiPermissionService.php`, `canEditUser()`: ```php public function canEditUser(int $userId, int $targetUserId): bool { if ($this->userHasPermission($userId, 'user_is_ueberuser')) { return true; } if ($userId === $targetUserId && $this->userHasPermission($userId, 'user_edit_own')) { return true; } // User with user_edit_others can edit ALL users, including superusers if ($this->userHasPermission($userId, 'user_edit_others')) { return true; } return false; } ``` There is no check on whether the target is a superuser. Compare this with the web