[josephcsible]

It sounds to me like the sales users have full admin access, and just don't need most of the access that they have. If that's the case, then this still isn't a vulnerability, but I admit it would be one otherwise.

[nerdawson]

The reference to roles left me with the impression that these users had limited permissions but I know nothing about OpenCart so I may be mistaken.