An incorrect authorization flaw exists in the `update()` function within `app/Http/Controllers/Users/UsersController`. The single-user edit route assigns the `activated` field from the request payload before evaluating the `canEditAuthFields` authorization gate. This allows an authenticated non-admin user with the `users.edit` permission in the target's company scope to send a PUT request to the '/users/{id}' endpoint and toggle the `activated` flag for any user, including admin and superuser accounts. Deactivating an admin account results in that account being locked out of the application. Only the `activated` field is affected; other sensitive data and the API are not impacted.