cPanel prior to 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
cpanel cpanel