Privilege Escalation

craftcms/cms is vulnerable to Privilege Escalation. The vulnerability is due to the actionSave function within ElementsController.php, because there are no checks for save permissions before and after applying POST params to the element, as well as the actionSaveUser function within UsersController.php not checking the permissions when setting the username based on user-provided input. This allow an unprivileged user to perform actions they shouldn’t be authorized to do.