Look beyond the named row
Tvheadend's developer documentation notes that anonymous wildcard entries can match any username within their applicable network scope. It also describes combining fields across matching entries. A narrow named row therefore needs to be reviewed with the other matching rows.
Trace the unexpected permission
Record the task the ordinary account can perform unexpectedly. List each enabled applicable entry and the relevant permission or profile field. Check order and the installed merge controls rather than assuming the last familiar account name is the only contributor.
Keep a protected configuration copy and administrative recovery route. Do not delete every anonymous row at once or add an unrestricted replacement as an experiment. Make the smallest understood change and preserve the previous value.
Verify both access and restriction
Retest an ordinary required task and the unwanted capability from the same client context. Record the server version and changed entry. No configuration was tested for this article, and this audit does not recommend exposing the server publicly or removing authentication.
Questions answered
Can a wildcard entry matter for a named login?
Yes, within its documented matching scope. Include it in the effective-access review.
Does one restrictive-looking row prove the effective result is restricted?
No. Inspect all applicable entries and combination controls.
Sources & further reading
Official references for the subjects discussed. Service terms and device software can change.