I have a team site collection inside my sharepoint enterprise server 2013. now i have the built-in group named "Visitors" which have "Read" permission level. and i added multiple AD groups and single users to this group. now members of the "Visitors" group can Read all the site pages + lists items.
now i need to implement a scenario which allow "Visitors" members to add new members to the "Visitors" group.
so i specify the Group Owner for the "Visitors" group to be the "Visitors" group itself. so in this case members of the "Visitors" group will be the group owner, and hence they can add new members. and till now everything is working well.
but i am afraid if doing my above implementation can raise the following security risks inside my sites:-
will the Group owners get extra permissions (beyond the Read permission) on my list items and/or on the site pages when they became part of the Group Owners??
can the Group owner who have Read permission on the site, modify his Group permission level? and grant it extra permission?. so for example can the "Visistors" group owners grant the "Vissiotr" group Edit or Contribute permission?? so in this case Visitors will have Edit permission on the site? or this is not possible, and group owners can only add/remove members, rename the group, but can not grant it extra permission levels??