cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).Referenceshttps://documentation.cpanel.net/display/CL/82+Change+Log
