SECURITY: Moderators can no longer edit user's emails.

This prevents moderators from potentially taking over another user account
by updating their email, which doesn't ask for confirmation when the
"require_change_email_confirmation" setting is disabled.

lib/guardian/user_guardian.rb

@@ -32,8 +32,10 @@ module UserGuardian
   def can_edit_email?(user)
     return false if SiteSetting.auth_overrides_email?
     return false unless SiteSetting.email_editable?
-    return true if is_staff?
+    return true if is_admin?
     return false if is_anonymous?
+    return false if is_moderator? && !is_me?(user)
+
     can_edit?(user)
   end
 

spec/lib/email_updater_spec.rb

@@ -413,6 +413,16 @@ RSpec.describe EmailUpdater do
     end
   end
 
+  context "when a moderator tries to change another user's email" do
+    let(:moderator) { Fabricate(:moderator) }
+    let(:user) { Fabricate(:user, email: old_email) }
+    let(:updater) { EmailUpdater.new(guardian: moderator.guardian, user: user) }
+
+    it "raises an invalid access error" do
+      expect { updater.change_to(new_email) }.to raise_error(Discourse::InvalidAccess)
+    end
+  end
+
   context "when hide_email_address_taken is enabled" do
     before { SiteSetting.hide_email_address_taken = true }
 

spec/lib/guardian_spec.rb

@@ -2206,8 +2206,12 @@ RSpec.describe Guardian do
         expect(Guardian.new(user).can_edit_email?(user)).to be_truthy
       end
 
-      it "is true for moderators" do
-        expect(Guardian.new(moderator).can_edit_email?(user)).to be_truthy
+      it "is true for moderators to edit their own email" do
+        expect(Guardian.new(moderator).can_edit_email?(moderator)).to be_truthy
+      end
+
+      it "is false for moderators to edit another user's email" do
+        expect(Guardian.new(moderator).can_edit_email?(user)).to be_falsey
       end
 
       it "is true for admins" do