cPanel prior to 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
cpanel cpanel