UserGroup model missing VIEW_MEMBERS permission

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.X EE, 6.2.X EE, 7.0.0 M3
• Fix Version/s: 6.2.2 CE GA3 , 6.2.X EE, 7.0.0 M2
• Component/s: Application Security > Permissions, Security Vulnerability, User Management, User Management > User Groups
• Labels:
  • QA-TP
  • liferay-fixpack-platform-27-6210
• Branch Version/s:
  6.2.x
• Backported to Branch:
  Committed
• Story Points: 9
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/20619

Steps to reproduce

1. Login as admin
2. Go to Control Panel -> Roles
3. Create a custom role named User Group Viewer
4. Define Permissions on the new role
   • Portal - General
     • Add - Go to Control Panel
   • Portal - Users and Organizations - User
     • Add - View
   • Portal - Users and Organizations - User Groups
     • Add - Assign Members
     • Add - View
   • Control Panel:Portal - User Groups
     • Add - Access in Control Panel
     • Add - View
     • Note that View Members is not an option though it should be added (this should exist after the fix)
5. Add a User Group "Test User Group" with at least one user.
6. Create a new user and assign the User Group Viewer role to them.
7. Login as the new user
8. Go to Control Panel -> User Groups
9. Verify that the user can see the list of Users in the "Test User Group" and manage them.
10. Now, go to the corresponding User Group JSON API - http://localhost:8080/api/jsonws?signature=/user/get-user-group-users-1-userGroupId.
11. Supply the userGroupId (discovering by viewing the User Group and examining the HTML form, or by doing an SQL query).
12. Click Invoke.

Result
EXPECTED: The list of users assigned to the User Group should be displayed.
ACTUAL: PrincipalException is thrown.