CVE-2017-15052: TeamPass Improper Privilege Management

The vulnerability stems from missing access control checks in user management operations. The commit diff shows critical additions of privilege checks (e.g., verifying admin status, isAdministratedByRole, and user_can_manage_all_users) in multiple case handlers like 'delete_user' and 'admin'. These functions previously executed destructive operations based solely on user-provided IDs without validating the requester's permissions over the target user. The patch explicitly adds these checks, confirming these were the vulnerable points.