Product
A vulnerability in Poweradmin's REST API user-update endpoint allows a non-admin user with 'user_edit_others' permission to reset any user's password, including superusers, leading to full administrative account takeover by exploiting inconsistent authorization rules between the API and web UI.