Kyle, are you sure? (re: nothing to do with CB). I know it's a somewhat silly question asking you guys
but... I have 3 environments all running the same stuff. On 2, I just upgraded to CB 1.8 and they now throw the error. The 3rd has older CB. Older version still works fine, allowing SA to reset password. The new ones don't. Here's what seems to have changed in your comprofiler::sendNewPass() function:
used to be (around line #1849):
$sql = "UPDATE #__users SET password = " . $_CB_database->Quote( $newpass ) . " WHERE id = " . (int) $user_id;
Now it is:
if ( ! $user->storePassword() ) {
which ultimately calls Juser:store(), which then in turn fails due to SA check. I agree that CB should behave just like Joomla so I am all for closing the loopholes. That's why I asked if you intentionally plugged that hole but seems like it was just a by-product of changes in 1.8. That's fine too.