Unmuting a user can promote them to admin based on room permissions

[spotlightishere]

Steps to reproduce

1. Create a public room with a first user. Ensure the first user has admin privileges (which they should, as they are the creator of the room), and the room has default permissions.
2. Invite a secondary user to the room, with default permissions (0).

Presume the secondary user begins to spam, i.e. in the event of a mass raid of the room.

3. As the first user (admin), set the room's default "Send messages" permission level to Admin.
4. As the first user (admin), select the second (default) user from the members list and press "unmute".
5. The second user (default, pictured below to be @spot:yuri.im) can be observed as being promoted to admin.

Outcome

What did you expect?

Having no prior knowledge of how power levels typically function in Matrix, I expected the user to be granted a specific permission to speak. This does not appear to be possible, and the user was irreversibly promoted to admin.

A few thoughts:

• If promotion is expected, a warning with "Promoting a user to admin is irreversible." or a similarly thwarting message would be highly desirable.
• If the permission change is ill-advised, a warning should be displayed when changing the room's default send messages permission to admin only.
• The unmute button is dangerously close to the ban button, the only difference being its color. It was far too easy to mistakenly click unmute instead of ban while dealing with waves of users, leading to this issue.

What happened instead?

The spamming user was irrevocably promoted to admin. Thankfully the spammer was no longer utilizing the account, and my room was not otherwise destroyed.

---

It seems element-hq/element-meta#1475 is very similar, where the UI provides no hint of what may occur.

Operating system

macOS

Application version

Element version: 1.10.6 Olm version: 3.2.8

How did you install the app?

https://element.io/get-started

Homeserver

awau.uk running Synapse 1.53.

Will you send logs?

Yes

[MadLittleMods]

It seems like element-hq/element-meta#1475 is a suitable enough duplicate. The extra non-reversible 100 power level admin is an extra level of bad though (comment on that issue around this)