Language: PHP
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
    public function getProfileEditMenu($profile) {

        $menu = [];

        $menu[] = [
            'title' => LANG_USERS_EDIT_PROFILE_MAIN,
            'url'   => href_to_profile($profile, ['edit'])
        ];

        if ($this->cms_template->hasProfileThemesOptions() && $this->options['is_themes_on']) {

            $menu[] = [
                'title' => LANG_USERS_EDIT_PROFILE_THEME,
                'url'   => href_to_profile($profile, ['edit', 'theme'])
            ];
        }

        if (cmsEventsManager::getEventListeners('user_notify_types')) {

            $menu[] = [
                'title' => LANG_USERS_EDIT_PROFILE_NOTICES,
                'url'   => href_to_profile($profile, ['edit', 'notices'])
            ];
        }

        if (!empty($this->options['is_friends_on'])) {

            $menu[] = [
                'title' => LANG_USERS_EDIT_PROFILE_PRIVACY,
                'url'   => href_to_profile($profile, ['edit', 'privacy'])
            ];
        }

        $menu[] = [
            'title' => LANG_SECURITY,
            'url'   => href_to_profile($profile, ['edit', 'password'])
        ];

        $menu[] = [
            'title' => LANG_USERS_SESSIONS,
            'url'   => href_to_profile($profile, ['edit', 'sessions'])
        ];

        list($menu, $profile) = cmsEventsManager::hook('profile_edit_menu', [$menu, $profile]);

        return $menu;
    }