Read-only user can update schema

[n2iw]

I created a read-only user on Neo4j. It could read data but not write data in Neo4j browser, it couldn't run "call graphql.idl..." either. However, I could use this user in a GraphQL client (like Insomnia) then do a POST to "/graphql/idl/" with schema payload, and successfully updated schema on the server! It's very serious issue, please fix this ASAP thanks!