Incorrect Privilege Assignment

Summary

A vulnerability has been identified within Rancher where a Restricted Administrator can change the Administrators' password and take over their accounts. A Restricted Administrator should not be allowed to change the password of more privileged users unless it includes the Manage Users permissions. Rancher deployments where the Restricted Administrator role is not being used are not affected by this vulnerability. This issue affects github.com/rancher/rancher package versions 2.8.x prior to 2.8.14, 2.9.x prior to 2.9.8, and 2.10.x prior to 2.10.4.