When non-admins are changing their role, instead of posting one of the role ids available on the page, they can post the role id of admin role - this assigns them an admin role.
Some kind of check should be made when updating roles not to allow non-admins to assign admin roles.
When non-admins are changing their role, instead of posting one of the role ids available on the page, they can post the role id of admin role - this assigns them an admin role.
Some kind of check should be made when updating roles not to allow non-admins to assign admin roles.