Admin privilege escalation security bug

Hello,

I believe it's possible to gain admin access to any account which hasn't got a 'premium' subscription.

Fairly simple really, generate a invoice link to upgrade their account. The email addresses you provide automatically gain admin access to the associated account without any authorisation from the origin account.

While it leaves a fairly good audit trail (unless you're using a stolen CC) it should allow you to escalate rights on any account.

Hopefully I'm wrong