Redmine

If the user is an administrator, the user can edit the field even if the field is set as "Read-only".
It is the expected behavior.

Redmine applies the most-open rules for fields permissions to users.

If a user has multiple roles in a project, they can edit the field if any of the roles allows editing the field. Similarly, they can leave the field unset if any of the user's roles does not enforce the field to be required.

Please check all of the roles for the user in the project. If you still observe the issue, please provide detailed information about the roles of the user in the project, details about the fields permission settings for all of these roles, as well as details about the specific issue (given that the permissions are specific to a specific tracker and status).