An issue exists where incorrectly configured access control security levels allow for missing authorization. This is caused by a missing capability check in a function, enabling authenticated attackers with contributor-level access or higher to perform unauthorized actions.