Privilege escalation in RBAC system

A flaw in Google's Exposure Notification Verification Server allows someone with basic user-writing permissions to trick the system into creating a new user account with more powerful access rights than they should be able to grant. This happens because the system doesn't properly validate which permissions can be assigned.

Insufficient input validation in the RBAC permission assignment logic allows an attacker with UserWrite privileges to escalate permissions by crafting a malicious request or proxy manipulation to create users with elevated privileges. The vulnerability affects versions prior to 0.23.1 and is detectable through Event Log entries; exploitation requires both UserWrite permission and the ability to intercept or craft requests.