ID: CVE-2024-0439
Published: 2024-02-26T16:27Z
Description: description_data: As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request

While this is not a critical vulnerability, it does indeed need to be patched to enforce the expected permission level.
CWE: problemtype_data: description: CWE-269