cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).Referenceshttps://documentation.cpanel.net/display/CL/62+Change+Log
