Open Roles, select the existing role, and compare its current permissions with the access actually required. Change the smallest possible set of feature and brand permissions, then save. A role can be assigned to several people, so every change can affect more users than the person who reported the problem.
Ask an assigned user to sign out and back in and test both the navigation entry and the intended action. If access is still unexpected, review all roles assigned to that user because effective access may combine them. Keep at least one working company administrator throughout the change.
Do not convert a normal user role into a broad administrator role to fix one hidden button. Record the previous permissions before editing so you can restore them, and create a separate role when only one team needs the new access.