Craft CMS contains a vulnerability that allows any authenticated user to change their own password without providing the current password or having an elevated session. Additionally, users with the 'Edit users' permission can change other users' passwords, including administrators, despite lacking the 'Administrate users' permission. This flaw exists due to improper validation in the user password update process, bypassing intended security checks.