Asynchronous operations are being allowed on protected default versions for portal users that are not version administrators

Description

Operations against feature services with branch versioned data that use asynchronous processing are being allowed for portal users that are not version administrators when the default version has protected access.  This impacts branch versioned workflows using feature services that have the version management capability enabled.

Note:
When working with branch versioned data, the Default version can be set to Protected to prevent portal users with limited permissions from editing and/or posting to the Default version. Portal users that are not version administrators are not allowed to perform operations such as directly editing or posting to a protected default version.

For more information about version access for branch versions, see: Manage branch versions

Users that do not have elevated privileges are incorrectly able to post, validate topologies, and complete utility network workflows against a protected Default version when running the process asynchronously. This occurs even when the version access is set to protected. These are standard users that are not considered version administrators for the service. 

This issue is reproducible when:

• Using the Reconcile REST endpoint directly with the withPost and async option set to true.
• Using the Post REST endpoint directly with the async option set to true.
• Using the Reconcile Versions geoprocessing tool with the Post Versions After Reconcile option checked. Starting with ArcGIS Pro 2.9 and ArcGIS Enterprise 10.9.1, this tool runs asynchronously.
• Using the Evaluate REST endpoint directly with the async option set to true.
• Using the Validate Topology geoprocessing tool. Starting with ArcGIS Pro 2.6 and ArcGIS Enterprise 10.8.1, this tool runs asynchronously. 
• Using the ExportSubnetwork REST endpoint directly with the async option set to true.
• Using the Export Subnetwork geoprocessing tool. Starting with ArcGIS Pro 2.9 and ArcGIS Enterprise 10.9.1, this tool runs asynchronously.
• Using the UpdateSubnetwork REST endpoint directly with the async option set to true.
• Using the Update Subnetwork geoprocessing tool with the All subnetworks in tier option checked. Starting with ArcGIS Pro 2.2 and ArcGIS Enterprise 10.6.1, this tool runs asynchronously.
• Using the ValidateNetworkTopology REST endpoint directly with the async option set to true.
• Using the Validate Network Topology geoprocessing tool. Starting with ArcGIS Pro 2.1 and ArcGIS Enterprise 10.6, this tool runs asynchronously.

Cause

The issue is specific to how the permissions are handled while executing the various REST endpoints asynchronously.

Workaround

To work around the problem, run the processes synchronously. 

• When using the REST endpoint, operations include both synchronous/asynchronous options.
• If using ArcGIS Pro 2.9, post the version through the Post button on the Versioning tab of the ribbon (performs the post synchronously).
• When using ArcGIS Pro 2.6 or higher, validate the topology using the Error Inspector (performs validation synchronously).

This issue is resolved in ArcGIS Enterprise 11.0 and higher and is included in the ArcGIS Server 10.9.1 Utility Network and Data Management Patch 2.