1K0Ct

The software fails to validate group-inherited super permissions within user-management guards. This allows users with manager privileges, who are not super-users, to modify super-admin accounts. An attacker possessing `api.access` and `api.users.write` permissions can patch password fields on group-super accounts to obtain full administrative control.

Insufficient page authorization verification occurs when resolving forms by name across pages. This allows anonymous visitors to execute form actions—such as saving, uploading, emailing, or calling—defined on unpublished or login-restricted pages. An attacker can trigger these actions by sending a POST request to any public page using the name of a restricted form.

A privilege escalation issue exists in the `InvitationsController` where the `stripSuperFlags()` function fails to remove dot-keyed equivalents such as `api.super`, only removing nested super flags. A user manager possessing `api.access` and `api.users.write` permissions can include a dot-keyed super flag in the access payload when creating an invitation. This bypasses the security guard and persists the flag to the new account. An attacker can then use the public endpoint to accept the invitation without the invitee's interaction, creating a super-admin account and obtaining a JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—for full site control.

Unauthenticated attackers can redirect password reset tokens to domains under their control by manipulating the `Host` header in the 'forgot-password' endpoint. By sending reset requests for any account using a malicious header, an attacker can intercept the reset token from the victim's email and achieve full account takeover, including super-admin accounts.