An issue exists in Couchbase Server prior to 7.0.4. XDCR lacks role checking when changing internal settings.
couchbase couchbase server