Product and version: FileMaker Pro 16 Advanced (188.8.131.522)
OS and version: Mac OS 10.13.1
Browser and version (for WebDirect only): n/a
Hardware: iMac (Retina 4K, 21.5-inch, Late 2015)
Description: When a user is assigned to a Privilege Set with a Value List's Security set to "All view only", the user is able to alter the Value List when "Edit..." is enabled in the UI. This is a security issue.
How to replicate: Create a database with a field in the UI; assign a static Value List; enable the field's value list to "Edit..."; add a user to Security & assign them to the "[Data Entry Only]" Privilege Set (i.e. which has the Value List "All view only" setting); login as this user & attempt to change the static value list.
Workaround (if any): (none)