Cobbler before 3.3.0 allows authorization bypass for modification of settings.
Published October 4, 2021.
Cobbler Project Cobbler