Note: If MISP.disableUserSelfManagement is enabled on the instance, non-admin users can not use the vulnerable endpoint.

Admins = org admins or site admins