[Security] Missing permission verification for the tree actions