Missing admin-target guard in UsersController::actionActivateUser can lead to permission escalation

A user with administrateUsers permissions can activate a deactivated administrator account.

This requires a control panel user account with administrateUsers permissions.

$this->userActionChecks();
$this->requirePermission('administrateUsers');   // 1079
$userId = $this->request->getRequiredBodyParam('userId'); // 1082
$user = Craft::$app->getUsers()->getUserById($userId);    // 1083
Craft::$app->getUsers()->activateUser($user);             // 1090  — no admin guard

The mirror action actionDeactivateUser (2199-2200) explicitly does if ($user->admin) $this->requireAdmin(false);. actionActivateUser does not.

A non-admin with administrateUsers can activate a pending/inactive admin account. When combined with activating and then resetting an admin’s password, or resurrecting a deliberately deactivated admin, this creates a privilege gap and breaks the symmetry between deliberate activation and deactivation.

Data flow

1. POST users/activate-user, userId=<admin id>.
2. Guard: administrateUsers (non-admin grantable). No admin-target check.
3. Sink: activateUser($user) activates the admin account.

Report ID: 1569