Missing authorization in the system API endpoint allows authenticated users to access sensitive information. Specifically, the '/api/system' endpoint leaks the installed Kirby version and the status, type, and code of the installed license to users who lack the `access.system` permission. This information can be utilized by malicious actors during reconnaissance to plan further attacks.