Steps to reproduce:
1. Create user Alice that has organisation administrator privileges and ROLE_SUDO
2. Create user Bob that also has organisation administrator privileges
3. Try to perform an request as Alice using user switchting to Bob
An unauthorized request is trying to switch to an admin user, from 'Alice' to 'Bob'
Since Alice has organization administrator privileges and ROLE_SUDO, Alice should be allowed to switch to other users that have organization administrator privileges - this is not a privilege escalation since Alice does have the required privileges
Workaround (if any):