UpdateService POST method have ConfigureComponents Privilege

Hi DMTF Team,

We facing the issue that Operator user can login to WebUI and start Firmware update.

Steps to reproduce the behavior:

1.Create a new user usertest from WebUI with Operator privilege.
2.Login to WebUI via usertest.
3.Click on Operators -> Firmware. In Update firmware -> Image file, click Add file to select new firmware. Then select Start update to start update process.
4.New firmware is uploaded and then update process start. After complete, the BMC boots with new firmware

Based on the the DMTF registries, the UpdateService's POST method has 'ConfigureComponents' privilege[1].
Reference Table 41 — Required standard roles in the redfish specification, which specifies Operator should have ConfigureComponents privilege[2].
That why Operator user can login to WebUI and start Firmware update.

Expect that only Administrator user can flash the firmware? For the UpdateService, need to change privilege to ConfigureManager?


[1] redfish.dmtf.org/registries/Redfish_1.3.1_PrivilegeRegistry.json#UpdateService
[2] www.dmtf.org/sites/default/files/standards/documents/DSP0266_1.15.0.pdf#Roles


Thanks