Read-only-admin authentication reconfiguration via missing authorization

Missing authorization in four Ivanti secure-access products allows remote authenticated users to alter authentication settings. Ivanti has not disclosed the affected endpoint or authorization check; the administration interface accepts authentication-setting changes from a read-only role. A read-only administrator account and network access to the administrative interface are required, and successful exploitation permits unauthorized security-policy changes.