CVE-2026-54357

@@ -50,9 +50,14 @@ public function index($user_id = null)
         // normal user
         $conditions = ['user_id' => $this->Auth->user('id')];
         // org admin can see people from their own org
-        if (!$this->_isSiteAdmin() && $this->_isAdmin()) { 
+        if (!$this->_isSiteAdmin() && $this->_isAdmin()) {
             $conditions = ['User.org_id' => $this->Auth->user('org_id'),
-                           'user_id' => $user_id]; 
+                           'user_id' => $user_id];
+            // An org admin must not see a site admin's login profiles.
+            $siteAdminRoleIds = $this->UserLoginProfile->User->getSiteAdminRoleIds();
+            if (!empty($siteAdminRoleIds)) {
+                $conditions['NOT'] = ['User.role_id' => $siteAdminRoleIds];
+            }
             $delete_buttons = true;
         }
         // full admin can see all users
@@ -99,14 +104,39 @@ private function __deleteFetchConditions($id)
             // no additional filter for siteadmins
         }
         else if ($this->_isAdmin()) {
-            $conditions['User.org_id'] = $this->Auth->user('org_id'); // org admin
-        } 
+            // Org admin: restrict to non-site-admin users of their own org.
+            // We filter on UserLoginProfile.user_id (an own-model column) rather
+            // than User.org_id, because the delete path runs finds with
+            // recursive => -1, where a condition on the associated User table is
+            // not joined and would raise an SQL error.
+            $conditions['UserLoginProfile.user_id'] = $this->__administrableUserIds();
+        }
         else {
             $conditions['UserLoginProfile.user_id'] = $this->Auth->user('id');  // normal user
         }
         return $conditions;
     }
 
+    /**
+     * User IDs the current org admin is allowed to administer: members of their
+     * own organisation, excluding site admins. Returns a value that matches no
+     * rows when the set is empty, so an empty result fails closed.
+     * @return array
+     */
+    private function __administrableUserIds()
+    {
+        $conditions = ['User.org_id' => $this->Auth->user('org_id')];
+        $siteAdminRoleIds = $this->UserLoginProfile->User->getSiteAdminRoleIds();
+        if (!empty($siteAdminRoleIds)) {
+            $conditions['NOT'] = ['User.role_id' => $siteAdminRoleIds];
+        }
+        $userIds = $this->UserLoginProfile->User->find('column', [
+            'conditions' => $conditions,
+            'fields' => ['User.id'],
+        ]);
+        return empty($userIds) ? [-1] : $userIds;
+    }
+
     public function admin_delete($id)
     {
         $profile = $this->UserLoginProfile->find('first', [

@@ -84,12 +84,17 @@ public function index()
         }
         if (!$this->_isSiteAdmin()) {
             if ($this->_isAdmin()) {
+                $orgUserConditions = array('User.org_id' => $this->Auth->user('org_id'));
+                // An org admin must not see a site admin's settings.
+                $siteAdminRoleIds = $this->UserSetting->User->getSiteAdminRoleIds();
+                if (!empty($siteAdminRoleIds)) {
+                    $orgUserConditions['NOT'] = array('User.role_id' => $siteAdminRoleIds);
+                }
                 $conditions['AND'][] = array(
                     'UserSetting.user_id' => $this->UserSetting->User->find(
                         'list', array(
-                            'conditions' => array(
-                                'User.org_id' => $this->Auth->user('org_id')
-                            ),
+                            'recursive' => -1,
+                            'conditions' => $orgUserConditions,
                             'fields' => array(
                                 'User.id', 'User.id'
                             )

@@ -1117,6 +1117,38 @@ public function getSiteAdmins($excludeUserId = false)
         ));
     }
 
+    /**
+     * Role IDs that grant site admin privileges.
+     * @return array
+     */
+    public function getSiteAdminRoleIds()
+    {
+        return $this->Role->find('column', array(
+            'conditions' => array('Role.perm_site_admin' => 1),
+            'fields' => array('Role.id')
+        ));
+    }
+
+    /**
+     * Whether the given user ID belongs to a site admin. Unlike getSiteAdmins(),
+     * this deliberately ignores the disabled flag: a disabled site admin must
+     * still be protected from lower-privileged (org) admins.
+     * @param int $userId
+     * @return bool
+     */
+    public function isUserSiteAdmin($userId)
+    {
+        if (empty($userId)) {
+            return false;
+        }
+        $target = $this->find('first', array(
+            'recursive' => -1,
+            'conditions' => array('User.id' => $userId),
+            'contain' => array('Role' => array('fields' => array('perm_site_admin')))
+        ));
+        return !empty($target['Role']['perm_site_admin']);
+    }
+
     public function verifyPassword($user_id, $password)
     {
         $currentUser = $this->find('first', array(

@@ -363,7 +363,12 @@ public function checkAccess($user, array $setting, $user_id = false)
          if ($user['Role']['perm_site_admin']) {
              return true;
          } else if ($user['Role']['perm_admin']) {
-             if ($user['org_id'] === $setting['User']['org_id']) {
+             // An org admin may not manage a site admin's setting, even when the
+             // site admin belongs to the same organisation.
+             if (
+                 $user['org_id'] === $setting['User']['org_id'] &&
+                 !$this->User->isUserSiteAdmin($setting['UserSetting']['user_id'])
+             ) {
                  return true;
              }
          } else {
@@ -570,17 +575,27 @@ public function setSetting(array $user, array $data)
             throw new MethodNotAllowedException(__('User self-management is disabled on this instance.'));
         }
         if (!empty($data['UserSetting']['user_id']) && is_numeric($data['UserSetting']['user_id'])) {
+            $targetUserId = $data['UserSetting']['user_id'];
             $user_to_edit = $this->User->find('first', array(
                 'recursive' => -1,
-                'conditions' => array('User.id' => $data['UserSetting']['user_id']),
+                'conditions' => array('User.id' => $targetUserId),
                 'fields' => array('User.org_id')
             ));
-            if (
+            // A user may always edit their own settings. A site admin may edit
+            // anyone's. An org admin may edit non-site-admin users within their
+            // own org. Anything else is an explicit authorisation failure rather
+            // than a silent fall-through to the acting user's own settings.
+            $authorised =
+                ($targetUserId == $user['id']) ||
                 !empty($user['Role']['perm_site_admin']) ||
-                (!empty($user['Role']['perm_admin']) && ($user_to_edit['User']['org_id'] == $user['org_id']))
-            ) {
-                $userSetting['user_id'] = $data['UserSetting']['user_id'];
+                (!empty($user['Role']['perm_admin'])
+                    && !empty($user_to_edit)
+                    && ($user_to_edit['User']['org_id'] == $user['org_id'])
+                    && !$this->User->isUserSiteAdmin($targetUserId));
+            if (!$authorised) {
+                throw new MethodNotAllowedException(__('You are not authorised to edit the settings of this user.'));
             }
+            $userSetting['user_id'] = $targetUserId;
         }
         if (empty($userSetting['user_id'])) {
             $userSetting['user_id'] = $user['id'];