Steps to reproduce

1. 1. Log into Administrator account
2. 2. Navigate to User section
3. 3. Create a new User, call it testUser pass is 12345678
4. 4. Navigate to Groups section and create a new group, call it testGroup
5. 5. Give a “manage:group” permission for testGroup and assign testUser to group
6. 6. Log into testUser account and navigate to Groups –> Permissions section
7. 7. Click on Update Group and intercept it by BurpSuit Iterceptor
8. 8. Change “permissions”:[“manage:groups”], to “permissions”:[“manage:system”]
9. 9. Relog in and obverse that we can manage system
10. 10. It can’t be done via GUI
11. 11. Video PoC: https://youtu.be/yd0uFCwEBiE