Several AJAX routes used for the backend localization wizard lack proper authorization checks. This allows authenticated users with low privileges to access information regarding records and content elements that are outside their permitted access range.