Administrator escalation via unprotected AJAX user form

Clickjacking in FreshRSS 1.26.3 and earlier allows remote authenticated users to gain administrator access after an administrator double-clicks. A user-details request with c=user, a=details, and ajax=1 returns a partial without JavaScript, leaving the Promote button without the full page confirm() protection. Exploitation requires a logged-in administrator to visit an attacker-controlled site and double-click while the attacker knows the instance URL and holds an account eligible for promotion.