Can edit profile fields of other users

maybe it's the line 63 :

return user_edit_access($GLOBAL['user']);

which must be :

return user_edit_access($user);

Because user_edit_access will always return TRUE with $GLOBALS['user'] passed as $account parameter (return (($GLOBALS['user']->uid == $account->uid) || user_access('administer users')) && $account->uid > 0;)

But i don't have tested that !

That worked and fixed the problem.
This needs to be committed in the next release. This is a pretty big security issue. Good find. Thanks!

I'll patch as I load or won't load at all. I'd like to think this should not be advertised unless fixed already. I intend to use this to deal with spammers who are sometimes hackers as well. So this could lead to more mahem than it solves.

I came across this security bug as well and can verify that sinasquax solution fixes the issue. Hopefully the maintainer will roll that fix into a new release asap.

Sorry about delay, I've been quite busy.

Thanks for posting the fix. I confirmed that it seems to do the job.

Committed.