Manager-to-Admin escalation via role parameter binding

Privilege escalation in OpenBoxes before 0.9.8 allows remote authenticated users to gain Admin access via user-management requests. In RoleInterceptor, user/save and user/update were gated only by the Manager-level changeActions prefix match, and UserController let Grails bind roles from request parameters onto the User object instead of forcing role changes through centralized authorization checks. Exploitation requires a Manager-role account and no user interaction; successful abuse can create or modify accounts with persistent administrative access inside the application.