Remove the permission to add general admin user by group admin

[blinak]

I have the following scopes for the group admin:
- ‘read:users’
- ‘admin:users!group=test-group’
- ‘admin:groups!group=test-group’
- ‘admin-ui’
needed to add/delete/create/read users to the specific group he manages, in this case test group. However in the add users section(as shown in the picture) this admin can add a general admin. I want the admin of the group to only be able to create and add simple users to the group, not admins.

[blinak]

help is much appreciated

[minrk]

This can be fixed by upgrading to JupyterHub 4.1.6 or 5.1.0. admin:users is not meant to grant access to the admin property, reported as CVE-2024-41942
.