cPanel prior to 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
cpanel cpanel