Allow user to delete their own account from the front end I'd like to allow a non-admin user to remove their own account from the front end of my app, without allowing them CP access.

I'm concerned that if I give the user group deleteUser permissions they will just be able to delete any other non-admin user if they change the values of my forms hidden inputs.

Here is my current form:

&lt;form method="post" accept-charset="UTF-8"&gt;
  {{ getCsrfInput() }}
  &lt;input type="hidden" name="action" value="users/deleteUser"&gt;
  &lt;input type="hidden" name="redirect" value="account/delete/success"&gt;
  &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;
  &lt;button type="submit" class="btn  btn--red"&gt;Delete my account!&lt;/button&gt;
&lt;/form&gt;


Is it best that I create a custom controller action to handle this and first check they are only deleting themselves before passing it off to the craft()-&gt;users-&gt;deleteUser() function? Or is there a better way?
I think you hit the nail on the head!

Including the userId in the front-end form give them the perfect opportunity to delete whoever they want... even just by guessing random IDs. That definitely seems like a huge security risk.

But if you build your own custom controller, you can guarantee that the current user is the one being deleted.