Note: If MISP.disableUserSelfManagement is enabled on the instance, non-admin users can not use the vulnerable endpoint. Admins = org admins or site admins