Guest accounts can push updates by directly interacting with the wwwupdate.cgi endpoint, which only checks if a session exists but not the role associated with it.

CWE: CWE-269:Improper Privilege Management