So I sent this bug report to SE by e-mail, but they told me to post it here...
It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator tools" privileges, simply by modifying a normal "flag" link using standard developer tools in their browser. This is very easy to do:
- Right-click the "flag" link.
- Select "inspect element" from the context menu.
- Change the class name from "
flag-post-link" to "
- Click the link normally and select "it has invalid flags" in the popup that appears.
Click any "flag" link on the page and select "it has invalid flags".
Turning this into a bookmarklet / user script is left as an exercise. Or you could modify this user script to work on all pages instead of just the 10k flag review page.
I have successfully used this technique to cast a dispute flag on a question here on meta, despite having only 3.5k rep here, and even though the question did not actually have any prior flags to dispute:
In principle, this could allow any user to dispute flags on their own posts, if they knew they had been flagged.
While I doubt this would be a very serious issue in practice, and it should be easy enough for mods / staff to detect if it happens, it would still seem a good idea to add a check to the backend so that such flags would be rejected if the flagging user doesn't have 10k privileges.