Guest accounts can upload content with privileges of user/admin by directly interacting with the wwwupload.cgi endpoint, which only checks if a session exists but not the role associated with it.

CWE: CWE-269:Improper Privilege Management