In Craft CMS versions 5.6.0 to 5.9.14, the actionSavePermissions() endpoint allows users possessing only the viewUsers permission to remove users from all user groups without proper authorization. While additions to user groups are checked for authorization, removals are not, enabling unauthorized removal by submitting an empty groups value. This missing authorization (CWE-862) vulnerability is addressed in version 5.9.15.

An attacker with viewUsers permission can remove arbitrary users from all user groups, potentially disrupting user access controls and group-based permissions within the CMS. This could lead to unauthorized privilege changes or denial of group-based functionalities for affected users. There is no indication of remote code execution or data disclosure from this vulnerability.

Upgrade Craft CMS to version 5.9.15 or later, where this authorization issue has been patched. Since the vendor advisory confirms the fix in 5.9.15, applying this official update is the recommended remediation. No additional mitigations are specified.