Non Adminstrator Users able to change their own role to Administrator

[officialgithub]

Describe the Bug

After login with non-admin-role user, I request patch to /users/:id?access_token={jwt} with { role:1, first_name:'Ronda'} and the result is user's role changed to admin-role. Even if in permission of directus_users, this field is not writable.

To Reproduce

Create Reguler User Role (ex. Content Writer) with no app and admin access. Login with axios, use jwt and send patch to /users/:id?access_token={jwt} with value {role:1}

Errors Shown

No response

What version of Directus are you using?

8.8.1

What version of Node.js are you using?

What database are you using?

MySql

What browser are you using?

Chrome

How are you deploying Directus?

DigitalOcean Image

[rijkvanzanten]

v8 has been deprecated and has been end-of-life for over 2 years. Please don't rely on it in production. Use the latest version instead.