An issue exists in Joomla! Core prior to 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions.
joomla joomla\\!