cPanel prior to 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).
cpanel cpanel