HestiaCP (< 1.10.5)

HestiaCP versions prior to 1.10.5 contain an authorization bypass vulnerability allowing non-privileged administrators to impersonate the ROOT_USER and execute arbitrary cron tasks.