If a user topic SomeUser topic contained in SomeGroup is renamed to SomeOtherGroup then the user topic can be used to enlarge the set of users belonging to the initial SomeGroup.

This is not a bug, because the rename code correctly checks for ALLOWCHANGETOPIC of the SomeGroup and renames links in it only if the user has change privilege on that topic.

I am wondering if there is some way to use this to gain higher privileges ...

If so, all TWikiAdmins should keep a vigil eye on the ALLOWWEBRENAME property of the %MAINWEB% and ALLOWTOPICCHANGE in all groups topics.

I should update my GroupsMap to take care of this ...

-- AndreaSterbini - 01 Jan 2002