Two things:

1. findings with a potential security-impact should always be reported to security@joomla.org, not in public tracker tickets
2. you are mixing access levels (which control view permissions) with ACL permissions. Permissions control what a user can do (create, update, delete etc), while access levels control what users see. It might seem counter-intuitive, but these two systems work independently from each other and therefore it's currently expected behavior that you can update the state of an entity that you can't see because the view levels mismatch.

So, I would suggest to close this issue.

@TawareAditya thank you for your interest in Joomla.
As @SniperSister explains, this is a misunderstanding. So I close this and your other issues.