The Poweradmin REST API user-update endpoint (PUT/PATCH /api/v2/users/{id} and the V1 equivalent) fails to enforce two key authorization rules that the web interface enforces: preventing non-superusers from editing superuser accounts and requiring a separate permission to change other users' passwords. The API's canEditUser() method grants users with 'user_edit_others' permission the ability to edit all users, including superusers, without restriction. Additionally, the updateUser() method updates passwords without verifying the 'user_passwd_edit_others' permission. This allows a non-admin user with 'user_edit_others' permission to reset the superuser's password and take over the superuser account, resulting in full privilege escalation. The web UI explicitly blocks these actions, but the API is inconsistent, creating a serious security gap.

A user with the 'user_edit_others' permission but without superuser privileges can reset the password of any account, including superusers, via the API. This leads to full privilege escalation and complete account takeover of the superuser account. The vulnerability undermines the intended permission model and allows unauthorized administrative access, potentially compromising the entire system's security and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users only and avoid granting the 'user_edit_others' permission to non-superusers. Monitor for updates from the Poweradmin maintainers and apply patches promptly once released. Do not rely on the API for user management if this vulnerability is present.