In cPanel prior to 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
cpanel cpanel