Privilege escalation via unchecked role hierarchy

Incorrect authorization in RuoYi 4.8.0 allows remote authenticated users with user-management access to assign themselves higher roles. The user-information update interface checks whether the requester may change a role but does not compare the target role's privilege level before saving it. Exploitation requires user-administration privileges and an existing higher-privileged role; success expands access to interfaces granted to that role.