cPanel prior to 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
cpanel cpanel