Nick SzaunigandClaude Opus 5.5
c4a11b4704
A role with users:update could reset an administrator's password or MFA, change the admin's email to one it controls, or give a colluding account the ADMIN role (with users:assign-role) - and so become administrator. Every management action (update, deactivate, activate, reset password, reset MFA) and every role assignment now requires the target role's grants to be a subset of the caller's own, like role editing already did. The target role is read from its grants, so a deactivated admin still counts as an admin. Changing another user's email revokes their sessions. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>