Security issue: a user with access to User Manager can change his own user group #10775
Description
Steps to reproduce the issue
Create a subgroup of administrator
for example "testgroup"
Deny some permissions for that group, for example Create, Edit, etc. (anything for the sake of the demonstration) globally or for any component.
Log with a user member of the "testgroup"
Go to User Manager, edit the user, change his group to Administrator
Expected result
One should have an error stating that a user can't change group
Actual result
The user can make himself administrator...