In Exponent CMS prior to 2.4.1 Patch #6, certain admin users can elevate their privileges.
exponentcms exponent cms 2.4.1
exponentcms exponent cms