Administrator account deletion via missing role check

Improper authorization in Dolibarr ERP & CRM 23.0.0 through 23.0.4 allows remote authenticated users to delete administrator accounts. The confirm_delete path in htdocs/user/card.php accepts an attacker-controlled user ID and calls User::delete after checking only generic user-deletion rights, without verifying that a non-administrator is not targeting an administrator. An account with permission to delete other users and a valid CSRF token can remove an administrator, eliminating administrative access when the sole administrator is deleted.