Administrative privilege escalation via unchecked user creation

Privilege escalation in Grokability Snipe-IT before 8.6.0 allows remote authenticated users to create accounts with administrative privileges. The UsersController store() path removes a submitted superuser permission from non-superusers but fails to remove the admin permission before persisting a new user. Reachability requires an existing account with users.create permission; exploitation grants control of a newly created administrator account.