# Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Poweradmin REST API user-update skips superuser-edit and password-permission checks, letting a delegated user manager reset the admin password and take over.

- Payout: Research
- Severity: high
- Program: Poweradmin
- Found by: SaifSalah
- Disclosed: 2026-07-24
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-h4hf-v6w5-897x
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-h4hf-v6w5-897x
- Tags: area:web domain:api domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** REST API endpoint PUT/PATCH /api/v2/users/{id} (and V1 equivalent)
**Root cause:** ApiPermissionService::canEditUser grants user_edit_others holders edit rights over any target including superusers, and UserManagementService::updateUser writes the password field without checking user_passwd_edit_others, unlike the web UI which enforces both guards.
**Steps:**
1. As admin, create a permission template granting only user_edit_others and user_view_others; assign to a normal user `umgr`.
2. As `umgr`, generate an API key `pwa_umgr_key`.
3. Send `PUT /api/v2/users/1` with header `X-API-Key: pwa_umgr_key` and body `{"password":"NewAdminPass1!"}`.
4. Receive HTTP 200 `{"success":true,...}`; log in as administrator with the new password.
**How found:** Security review comparing the API permission service and user management service against the web controller's explicit superuser-edit guard and UserManager::editUser's password permission check, spotting the missing equivalents in the API path.
**Exploitation:** A low-privileged user manager with a self-scoped API key sends one PUT to the sequential admin user id (usually 1), overwriting the superuser password, then authenticates as admin to control all zones, records, users and settings, and via PowerDNS the DNS data itself.
**Escalation:** Full administrative takeover from delegated user-manager role; also allows changing username, email, active and use_ldap on any account.
**Insight:** When an app has separate permissions like user_edit_others and user_passwd_edit_others, audit every alternate entry point (REST V1/V2, API keys) for the same guards the web controller enforces; API permission services often reimplement checks incompletely.

## Proof of concept (copied exactly from the original report)

**PUT request resetting admin password via API**

```
PUT /api/v2/users/1 HTTP/1.1
Host: TARGET_HOST
X-API-Key: pwa_umgr_key
Content-Type: application/json
Content-Length: 30

{"password":"NewAdminPass1!"}
```