When a command with a macro runs, the resulting command gets cached. If the macro is ran again with the same parameter values it will use the cached command to increase performance. However, it also ignores the required operator permission level when doing so. This could allow someone to run a command that they should not have access to.

For example, a level 3 or 4 command (like /jfr, /op or /save-off) can run in a context that should only have operator permission level 2 (like command blocks, functions and lower level operators), as long as it was previously cached.

How to reproduce:

1. Create a new creative mode world with the attached data pack activated.

2. Copy the following into a command block and activate it:

/function test:jfr {action:"start"} 

Result: Function fails to run (Correct behavior, the jfr command is too high level)

3. Run the exact same command in chat (should succeed).

4. Activate the command block again.
Result: Function successfully runs from command block (Incorrect behavior, the permission level of the jfr command is now ignored after being cached)

Function contents:

$jfr $(action)
say JFR function ran

How to reproduce (server):

1. Create a new creative mode server, op yourself and activate the attached data pack.

2. Copy the following into a command block and activate it:

/function test:op {name:"Steve"}

Result: Function fails to run (Correct behavior, the op command is too high level)

3. Run the exact same command in chat (should succeed).

4. Activate the command block again.
Result: Function successfully runs from command block (Incorrect behavior, the permission level of the op command is now ignored after being cached)

Function contents:

$op $(name)
say OP function ran