Timelock takeover via late operation-readiness check

Privilege escalation in OpenZeppelin Contracts allows remote attackers to seize TimelockController through a crafted operation batch. The executeBatch method checks readiness only after external calls, letting an unready batch lower the delay, grant proposer rights, and schedule itself. An executor-role holder, or any remote attacker when that role is open, can gain administrator control and unrestricted access to assets held by the contract.