LLDAP

Here's a brand new thread for you! Please keep the discussion for this problem in this thread.

I _think_ the issue means that a non-admin user can change an admin user's password... That's not great 😅

I mean, there's no UI for that, but with a well crafted client, it's possible

ah, no, there's a double-check, so it's not possible. Phew

Hmm, looking closer, the code seems correct: The logged in user needs to have the change-password permission for the target user, which it does if:
 - it's the same user (can change your own password)
 - it's an admin (can change every password)
 - it's a password manager and the target user is _not_ an admin (privilege escalation)

Something else happened in your session: I'm guessing that the current user somehow became admin _after_ logging in, and that the changes in permissions were not reflected until after logging out/back in

<@164488674061320192> Can you confirm that an admin can change a password_manager's password?

Yes. I think you are right about permissions not being refreshed. I may have done that without logging out I'm not sure