In Limesurvey prior to 3.17.14, admin users can access the plugin manager without proper permissions.
limesurvey limesurvey