Blocking a company page admin prevents him from delete paid media admin or edit his roles

Summary

Summary: A company page admin is prevented from managing (deleting or editing roles of) a paid media admin when that paid media admin blocks the company page admin. This creates an access control vulnerability where administrative privileges are circumvented through the platform's social blocking feature. The company page admin, despite having superior administrative permissions, cannot perform necessary admin functions on the paid media admin who has blocked them.

Considered low to medium risk, and fixed years ago.