REST user updates have to include the existing password in some cases

If the currently logged in user (the user under which the requests are performed) is changed by a REST request, the existing password has to be provided in case a protected field (e-mail addresss or password) is to be changed.

Consider the following example to change the password via REST:

PATCH request before:

{
  "pass": [
    {
      "value": "new-pass"
    }
  ]
}

PATCH request after:

{
  "pass": [
    {
      "value": "new-pass",
      "existing": "existing-pass"
    }
  ]
}

If the existing password is omitted, the following error will be thrown using the exit code 422:

Value 'Unprocessable Entity: validation failed. pass: Your current password is missing or incorrect; it's required to change the Password. ' is equal to value 'Unprocessable Entity: validation failed. pass: Your current password is missing or incorrect; it's required to change the Password. '.

API-level
The same applies on the API level, if the currently logged in user is updated and user validation is performed. In that case the existing password should be entered by the user and provided via the setExistingPassword()method on the user object.