Super-administrator takeover via unchecked password update

Privilege escalation in Feehi CMS 2.1.1 allows remote authenticated users to reset the built-in super administrator password via backend admin update. The administrator update action passes a selected account to the update service, while AdminUser checks the old password only in the self-update scenario and otherwise saves the new password. Exploitation requires a backend account with administrator-update permission; control of the new password enables access to the built-in super administrator account.