Insufficient capability checks made it possible to disable badges a user does not have permission to access.
CWE-863