Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CWE-862