Privilege escalation via self-service role changes

Broken access control in Trend Micro Trend Vision One allowed remote authenticated users to escalate privileges through account role changes. The Role Name component accepted a created user's role change without enforcing the privilege boundary intended for that account. Exploitation required an administrator to create the account before the authenticated user changed its role; elevated access remained within the hosted tenant.