CVE-2026-9851

An authenticated attacker with Editor-level access can exploit this vulnerability. The attacker targets the `package_app_action` AJAX endpoint, specifically the `updateUser` action. By manipulating the request, the attacker can bypass the nonce validation and directly invoke `Schedule::updateUser()` with a hardcoded administrator flag set to true. This allows the attacker to change the email and password of any user, including administrators, leading to a full site takeover [ref_id=1].

The vulnerability resides within the `package_app_action` AJAX endpoint, specifically in the handler for the `updateUser` action. The code fails to perform an adequate capability check before calling `Schedule::updateUser()`, which is then invoked with `$administrator` hardcoded to `1` [ref_id=1].

The patch is not provided in the bundle. However, the vulnerability description indicates that the fix would involve implementing a proper capability check on the `updateUser` AJAX endpoint. This check should ensure that only users with sufficient privileges can modify user data, thereby preventing unauthorized privilege escalation and account takeover.