Filters apply as you choose them.
Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.