    public function resetauthkey($id = null, $alert = false)
    {
        if (!$this->_isAdmin() && Configure::read('MISP.disableUserSelfManagement')) {
            throw new MethodNotAllowedException('User self-management has been disabled on this instance.');
        }
        if ($id == 'me') {
            $id = $this->Auth->user('id');
        }
        if (!$this->userRole['perm_auth']) {
            throw new MethodNotAllowedException(__('Invalid action.'));
        }
        $newkey = $this->User->resetauthkey($this->Auth->user(), $id, $alert);
        if ($newkey === false) {
            throw new MethodNotAllowedException(__('Invalid user.'));
        }
        if (!$this->_isRest()) {
            $this->Flash->success(__('New authkey generated.', true));
            $this->_refreshAuth();
            $this->redirect($this->referer());
        } else {
            return $this->RestResponse->saveSuccessResponse('User', 'resetauthkey', $id, $this->response->type(), 'Authkey updated: ' . $newkey);
        }
    }
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.