cPanel prior to 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
cpanel cpanel