If the owner of a VRChat group assigns themselves to a custom role that requires Two-Factor Authentication while their account does not have 2FA enabled, the website locks them out of all group management actions.
Because the user is the owner:
  • They cannot delete the group (requires 2FA).
  • They cannot change their role (UI blocks all actions until 2FA is enabled).
  • They cannot disable the 2FA requirement on the role.
  • They cannot leave the group because owners cannot leave.
Steps to reproduce:
  • Create a group.
  • Create a custom role that requires 2FA.
  • Assign this role to yourself (the owner).
  • Do not have 2FA enabled on your account.
  • Try to edit settings, change roles, or delete the group.