Commit "2b83a60f7763" (5.7.3) hardened the template editor: it added "TemplateEditorModuleVoter" + "CheckTemplateEditorSaveListener" so a non-admin cannot self-grant the "tpl_editor" backend MODULE (editable ".html5" templates = PHP = RCE). That voter supports ONLY the "modules" field and the literal value "tpl_editor". The equally RCE-capable "theme_import" capability lives in a DIFFERENT field - the "themes" checkbox field (tl_user_group.php:98-105 options include "theme_import"; identical on tl_user.php:248-253) - which has NO save_callback and NO voter. "TemplateEditorModuleVoter" is the only DC voter registered for tl_user_group, and it does not cover the "themes" field. So a delegated user manager can add "theme_import" to their own (or a managed) account. Live repro (Contao 5.7.9): 1. As admin, create a non-admin backend group with the "user" (or "group") module (a delegated user manager), and a user in it. Confirm the user cannot access "tpl_editor" (blocked by the 5.7.3 voter). 2. As that non-admin, edit a group/account: add "themes" to the modules field and "theme_import" to the themes field (both accepted - only "tpl_editor" is blocked). Re-authenticate. ## Impact A delegated user/group manager (a role explicitly NOT trusted with template/code access) escalates to arbitrary PHP execution on the server, fully compromising the installation. This bypasses the exact protection the 5.7.3 "tpl_editor" fix introduced. ## Credits This security vulnerability was found by @HDWSec