Subscriber account takeover via unbound reset token

Authentication bypass in AceWebX Ace User Management 2.0.3 and earlier allows remote authenticated users to reset arbitrary account passwords. The password-confirmation flow accepts a valid randNum token while trusting an independently submitted user_id, so the token is not bound to the account being changed. Subscriber-level access and a token issued for the attacker's own account are sufficient to replace an administrator password and take over that account.