Authenticated privilege escalation via unchecked role assignment

Privilege escalation in rConfig V8 Core before 8.2.8 allows remote authenticated users to grant any account the Admin role. StoreUserRequest accepts the Users API role field without an allowlist and authorizes requests by login status alone, then mass-assigns the value to the User model. Any authenticated non-admin account can create an administrator or promote itself or another account, gaining access to privileged application features.