    public function resetauthkey($id = null)
    {
        if (!$this->_isAdmin() && Configure::read('MISP.disableUserSelfManagement')) {
            throw new MethodNotAllowedException('User self-management has been disabled on this instance.');
        }
        if ($id == 'me') {
            $id = $this->Auth->user('id');
        }
        if (!$this->userRole['perm_auth']) {
            throw new MethodNotAllowedException('Invalid action.');
        }
        $this->User->id = $id;
        if (!$id || !$this->User->exists($id)) {
            throw new MethodNotAllowedException('Invalid user.');
        }
        $user = $this->User->read();
        $oldKey = $this->User->data['User']['authkey'];
        if (!$this->_isSiteAdmin() && !($this->_isAdmin() && $this->Auth->user('org_id') == $this->User->data['User']['org_id']) && ($this->Auth->user('id') != $id)) {
            throw new MethodNotAllowedException('Invalid user.');
        }
        $newkey = $this->User->generateAuthKey();
        $this->User->saveField('authkey', $newkey);
        $this->__extralog(
                'reset_auth_key',
                'Authentication key for user ' . $user['User']['id'] . ' (' . $user['User']['email'] . ')',
                $fieldsResult = 'authkey(' . $oldKey . ') => (' . $newkey . ')'
        );
        if (!$this->_isRest()) {
            $this->Flash->success(__('New authkey generated.', true));
            $this->_refreshAuth();
            $this->redirect($this->referer());
        } else {
            return $this->RestResponse->saveSuccessResponse('User', 'resetauthkey', $id, $this->response->type(), 'Authkey updated: ' . $newkey);
        }
    }
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.