Check user belongs to remote when updating profile image (#27008)

server/channels/api4/remote_cluster.go

@@ -271,6 +271,15 @@ func remoteSetProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetInvalidURLParam("user_id")
 		return
 	}
+
+	// ensure the user being modified belongs to the remote requesting the change.
+	requesterRemoteID := c.GetRemoteID(r)
+	if user.GetRemoteID() != requesterRemoteID {
+		c.Err = model.NewAppError("remoteSetProfileImage", "api.context.remote_id_mismatch.app_error",
+			nil, "", http.StatusUnauthorized)
+		return
+	}
+
 	audit.AddEventParameterAuditable(auditRec, "user", user)
 
 	imageData := imageArray[0]