“requires an authenticated attacker to have Administrator-level privileges” i.e. It’s not a vulnerability at all. No new privileges gained = no vulnerability, by definition.