Admin can remove Owner and Owner can remove themselves without ownership transfer

[syedasana333]

Description

Role permissions are not enforced correctly. Admin users are able to remove the Owner, and Owners can remove themselves without transferring ownership to another user first.

What is the expected behaviour?

• Admins should be able to remove other admins and members, but should not be able to remove the Owner.
• Owners should be able to remove other users.
• Owners should not be able to remove themselves unless ownership has been transferred to another user.

What is the current behaviour?

• Admin users are able to remove the Owner.
• Owners are able to remove themselves without transferring ownership.

How to reproduce the issue?

1. Log in as the Admin user.

2. Navigate to Team and attempt to remove the Owner.

3. Notice that the Owner can be removed.

4. Log in as the Owner.

5. Navigate to Team and attempt to remove yourself without transferring ownership.

6. Notice that the Owner can remove themselves without any ownership transfer.