Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.
Published August 6, 2019.
Schben Adive