Privilege Escalation

github.com/rancher/rancher is vulnerable to privilege escalation. An attacker with permissions to create/edit cluster role template bindings or project role template bindings is able to gain administrator permission in another project in the same cluster or in another project on a different downstream cluster, due to the improper authorization mechanism in the library.