CIVI-SA-2022-03: Permission Advice
This is not a security vulnerability. It is a mitigation to protect against misconfiguration.
CiviCRM includes a large number of configurable permissions. Administrators may assign these permissions to various users and roles. This is powerful functionality that accommodates diverse needs, but it provides the opportunity for misconfiguration.
Misconfigurations may arise for a few reasons, such as: