The issue described below is experienced on Odoo 12 CE.
The default Administrator, who is created upon DB creation is of type Administrator/Settings. For simplicity we name it User1. User1 creates User2. User1 gives Administrator/Access Rights to User2. Now User2 is able to:
- Delete User 1 ?!?!
- Self promote to Administrator/Settings ?!?!
How can we prevent User2 from both actions above and thus secure User1?
Thank you in advance for any suggestions.