"Non-Admin" user able to invite others to Private Space (by default)

[daniellekirkwood]

Steps to reproduce

1. User A: Created Private Space

2. Invited User B to Private Space

3. User B accepted invite to Private Space

4. User B able to invite other users to Private Space

What did you expect?

Expected User B to not have permission access to invite others to Space.
Would expect User A to explicitly grant higher levels of access to User B (or all) in order for User B to invite others to Private Space.

What happened?

User B was able to invite others to Space by default

Your phone model

No response

Operating system version

No response

Application version and app store

https://buildkite.com/organizations/matrix-dot-org/pipelines/element-android/builds/3224/jobs/a1fe572d-8a7b-4406-8a0f-37f4c9ff4787/artifacts/30990f61-8f7d-4dc6-af1e-340765110cc6

Homeserver

No response

Have you submitted a rageshake?

No

[t3chguy]

I can repro

m.room.power_levels event content

{
  "content": {
    "ban": 50,
    "events": {
      "m.room.avatar": 50,
      "m.room.canonical_alias": 50,
      "m.room.encryption": 100,
      "m.room.history_visibility": 100,
      "m.room.name": 50,
      "m.room.power_levels": 100,
      "m.room.server_acl": 100,
      "m.room.tombstone": 100
    },
    "events_default": 100,
    "historical": 100,
    "invite": 0,
    "kick": 50,
    "redact": 50,
    "state_default": 50,
    "users": {
      "@webdevguru_test15:matrix.org": 100
    },
    "users_default": 0
  },
  "origin_server_ts": 1630511431483,
  "sender": "@webdevguru_test15:matrix.org",
  "state_key": "",
  "type": "m.room.power_levels",
  "unsigned": {
    "age": 588
  },
  "event_id": "$7k-9UaBQvo05YC-7N6MnYTQaQia4ZTMf73pvc3_bqpc",
  "room_id": "!lfTKdOcJdaLHGVcXIG:matrix.org"
}

createRoom req

{
  "name": "test default permissions",
  "preset": "private_chat",
  "power_level_content_override": {
    "events_default": 100
  },
  "topic": "",
  "visibility": "private",
  "creation_content": {
    "type": "m.space"
  },
  "initial_state": [
    {
      "type": "m.room.guest_access",
      "state_key": "",
      "content": {
        "guest_access": "can_join"
      }
    },
    {
      "type": "m.room.history_visibility",
      "content": {
        "history_visibility": "invited"
      }
    }
  ]
}

[BillCarsonFr]

See element-hq/element-web#18909