CVE-2025-47938: TYPO3 Unverified Password Change for Backend Users

The vulnerability allows changing backend user passwords without verifying the current password. This issue manifested in two primary ways:

1. In the 'User Setup' module, handled by TYPO3\CMS\Setup\Controller\SetupModuleController::storeIncomingData. The existing logic for checking the current password was insufficient or could be bypassed, particularly for admin users. The patch removes this direct password checking logic.
2. In general backend user editing forms, where data is processed by TYPO3\CMS\Core\DataHandling\DataHandler::process_datamap. The DataHandler relied on TCA configurations, which, for the be_users.password field, did not mandate any specific authentication context (like current password check or step-up auth). The patch adds an authenticationContext to the TCA for the password field.

Both functions were involved in processing password change requests without adequate verification. The patches introduce a system-wide step-up authentication requirement for such sensitive operations, moving away from direct (and flawed) current password checks within specific controllers or relying on TCA to enforce stricter authentication for the DataHandler.