      user: function (done) {
        UserSchema.getUserByUsername(username, function (err, user) {
          if (err) return done(err)
          if (!user) return done('Invalid User Object')

          obj._id = user._id

          if (
            !_.isUndefined(obj.password) &&
            !_.isEmpty(obj.password) &&
            !_.isUndefined(obj.passconfirm) &&
            !_.isEmpty(obj.passconfirm)
          ) {
            if (obj.password === obj.passconfirm) {
              if (passwordComplexityEnabled) {
                // check Password Complexity
                const passwordComplexity = require('../../../settings/passwordComplexity')
                if (!passwordComplexity.validate(obj.password)) return done('Password does not meet requirements')
              }

              user.password = obj.password
              passwordUpdated = true
            }
          }

          if (!_.isUndefined(obj.fullname) && obj.fullname.length > 0) user.fullname = obj.fullname
          if (!_.isUndefined(obj.email) && obj.email.length > 0) user.email = obj.email
          if (!_.isUndefined(obj.title) && obj.title.length > 0) user.title = obj.title

          user.save(function (err, nUser) {
            if (err) return done(err)

            nUser.populate('role', function (err, populatedUser) {
              if (err) return done(err)
              const resUser = stripUserFields(populatedUser)

              return done(null, resUser)
            })
          })
        })
      },
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.