Bug reproduction steps:
- In admin trust level settings, set
min trust level to allow inviteto 2
- Login with a user belonging to a group and having trust level 1
Add Membersand invite new users
The invite is successfully sent despite the logged-in user not having sufficient privilege.
Fix is to check the current user’s trust level when adding new members of a group.