Security Finding (6.0) SEC-017: No Ownership Check on User Deletion

[DyanGalih]

Finding ID: SEC-017
Location: lib/Controller/User/Delete.php
CVSS: 6.0

User deletion allows deleting any user (including last super admin or self), with no ownership or last-admin checks.

Impact: Accidental or malicious deletion of critical accounts; potential admin lockout.

Remediation (short): Prevent self-deletion, prevent deleting the last super admin, and add proper authorization checks and audit logging.

Reference: SECURITY_REVIEW.md