The vulnerability in Craft CMS arises from the 'elements/save' action when saving a User element. The 'UserPasswordValidator' applies only a 'safe' validator to the 'newPassword' field without restricting it to specific scenarios, making 'newPassword' mass-assignable during the generic element save flow. This bypasses the dedicated 'users/set-password' action that enforces elevated session verification. Consequently, any authenticated user can change their own password without providing the current password. Furthermore, users with the 'Edit users' permission can change other users' passwords, including administrators, even though they lack the 'Administrate users' permission required for such actions.

Any authenticated user can change their own password without needing to provide the current password, potentially allowing account takeover if the session is hijacked or compromised. Users with the 'Edit users' permission can change any user's password, including administrators, enabling privilege escalation and full account takeover of high-privilege accounts.

A patch is available to address this vulnerability. It is recommended to apply the official fix provided by the vendor to ensure that password changes require proper verification and elevated session checks. Until patched, restrict 'Edit users' permissions to trusted users only and monitor for suspicious password changes. Patch status is confirmed as available; apply updates promptly.