Ticket #16860: 16860.diff

src/wp-includes/capabilities.php

@@ -1135 +1135 @@
                 if ( 'edit_user' == $cap && isset( $args[0] ) && $user_id == $args[0] )
                         break;
 
-                // If multisite these caps are allowed only for super admins.
-                if ( is_multisite() && !is_super_admin( $user_id ) )
+                // In multisite the user must be a super admin, or must have manage_network_users caps and not be editing a super admin.
+                if ( is_multisite() && ( ( ! is_super_admin() && 'edit_user' === $cap && is_super_admin( $args[0] ) ) ) || ! user_can( $user_id, 'manage_network_users' ) )
                         $caps[] = 'do_not_allow';
                 else
                         $caps[] = 'edit_users'; // edit_user maps to edit_users.