cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).Referenceshttps://documentation.cpanel.net/display/CL/60+Change+Log
