Account privilege alteration via CSRF user rename

CSRF in OpenNMS Horizon through 27.1.0-1 and affected Meridian releases allows remote attackers to alter user privileges. The administrative user-management route accepts state-changing rename requests without a CSRF token, while UserManager.renameUser removes the old account and overwrites an existing destination account without checking the new name. Exploitation requires an authenticated administrator's browser to submit the attacker-controlled request, which transfers the old account's privileges to the destination name and deletes the old name.