Super-administrator takeover via unchecked target authorization

Authorization bypass in Grav Admin Plugin 1.10.52 and earlier allows remote authenticated users to take over super-administrator accounts. The saveUser method loads the URL-selected account and applies the submitted password after checking only the caller's user-management permission, not authority over the target. A session with admin.users permission is sufficient to replace a super administrator's password and assume control of the site.