Unauthenticated Administrator escalation via unrestricted role update

Privilege escalation in imithemes Real Spaces 3.5 and earlier allows remote attackers to assign themselves the Administrator role. The profile-update path accepts the change_role_member parameter and writes the chosen role without restricting it to safe membership roles. The CNA description states that authentication is unnecessary, although its title and scoring treat Subscriber access as the gate.