Read-only administrator privilege escalation via missing authorization

Missing authorization in affected Ivanti secure-access products allows remote authenticated users to change restricted settings. The administrative configuration path accepts restricted-setting changes without enforcing the read-only administrator role's authorization boundary; Ivanti has not published the affected endpoint or function. Exploitation requires an authenticated read-only administrator account and permits configuration changes beyond that role, with no reported availability impact.