Language: PHP
Label: vulnerable
CWE: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Code:
            $dataitemtypes = json_decode($data['itemtypes']);
            if (in_array($itemtype, $dataitemtypes) != false) {
                $id = $data['id'];
            }
        }

        //profiles restriction
        if (isset($_SESSION['glpiactiveprofile']['id'])) {
            $profile = new PluginFieldsProfile();
            if (isset($id)) {
                $found = $profile->find(['profiles_id' => $_SESSION['glpiactiveprofile']['id'],
                    'plugin_fields_containers_id' => $id
                ]);
                $first_found = array_shift($found);
                if ($first_found === null || $first_found['right'] == null || $first_found['right'] == 0) {
                     return false;
                }
            }
        }

        return $id;
    }