Staff privilege escalation via writable account status

Improper access control in InvenTree before 1.2.7 allows remote authenticated users to grant their accounts staff status through the API. The user account endpoint accepts a POST that changes the staff-status field because its write permissions expose that field to non-staff users. Valid user authentication is required, and successful exploitation elevates only the attacker's own account to staff-level privileges.