Cross-scope device actions via authorization failure

Improper privilege management in Micro Focus ZENworks 2020 Update 3a and earlier allows remote authenticated users to act on out-of-scope devices. OpenText has not published the affected authorization-checking locus or the operation that fails to enforce the administrator's assigned device scope. An administrator must already hold rights to an action such as bundle installation; the flaw extends that same action to other zone devices without granting additional device rights.