If I have Who Can Publish but not Who Can Create, trying to Publish crashes
Summary: Create a Publishable Model. Create a Custom Role. Give that Role Who Can Publish, and Who Can Edit on the Model, but not Who Can Create. Add a Member with the Custom Role. Owner creates an Instance. Member edits it, and presses the Publish button -- they get a cryptic Unexpected Error.
This is only High solely because it is easy to work around. But it's mysterious enough that it may get elevated to Critical.
The issue is that "Publish" is actually "Create" from the POV of SpaceCore -- it is adding a Create event in the main History. So things fail when it gets into createSomething, because they don't actually have permission.