A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.