PT-2026-67606

Summary The REST API user-update endpoint PUT/PATCH /api/v2/users/id and the V1 equivalent does not enforce two authorization rules that the web interface enforces. A user who holds the user edit others permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2...