[Bug] permissions.manage.membership.builder can be used to delete others' other permissions group
Closed this issue · 1 comments
chuanwise commented
User with "permissions.manage.membership." can delete others' permission groups by "/pex user group set ".
For example, I have "permissions.manage.membership.builder" in a special world, but I'm just a world owner, no global owner.
I will use command "/pex user group add " to give others the permission to build with "/pex user group add ". I haven't access to delete other permissions.
But In fact, I can use command "/pex user group set " to set others' permission groups, and it will delete his all other permission group.
zml2008 commented
PEX v1 is no longer supported.