PSA: Manage Roles allows users to give themselves all channel permissions for all channels

Before anyone complains I'm posting this publicly instead of contacting security@discordapp.com: We've done that, they say it's intended behaviour (but subject to change).

Suppose you have a role called Moderator, with the Manage Roles permission. And you have a channel called #admins-only, with Read Messages denied for @everyone.

You may expect your Moderators to have no way of accessing your admin channel, since Manage Roles does not allow you to assign yourself a higher role (or give yourself role permissions you do not have).

However, Manage Roles also enables channel permission management, and there are no restrictions on this.

Moderators won't be able to see #admins-only in the official clients because you can't see channels you don't have read access to. However, the API lists all channels regardless of a user's permissions, and using the API, a Moderator can indeed add the "Read Messages" permission to themselves for #admins-only.

For channels that can be seen, this can be done from within the app too. If you have an #announcements channel that can be read by @everyone, but only Administrators have send permissions for - well, someone with Manage Roles can just add that permission for themselves.

So be careful who you give this to.

A friend of mine discovered this a few days ago, contacted Discord Security, who told him this isn't a bug, then he told me about it. I figured this might have been a miscommunication, so I also sent a mail to Security, making the core issue a little clearer. I also got a response saying it's "intended functionality at present", though they're considering changing exactly this behaviour at a later date.