Language: PHP
Label: vulnerable
CWE: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Code:
    public function removeUserFromProject($project_id, $user_id)
    {
        $project_id = $this->da->escapeInt($project_id);
        $user_id    = $this->da->escapeInt($user_id);
        $admin_flag = $this->da->quoteSmart('A');

        $sql = "DELETE FROM user_group
                WHERE group_id = $project_id
                  AND user_id = $user_id
                  AND admin_flags <> $admin_flag";

        return $this->update($sql);
    }