An improper access check allows privelege escalation through the com_users group editing webservice endpoint.