Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.