Language: Python
Label: vulnerable
CWE: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.

Code:
    def get_permissions(self):
        if self.action == "create":
            self.permission_classes = [
                IsRegistrationAllowed | FirstTimeSetupPermission | IsAdminUser
            ]
        elif self.action == "list":
            self.permission_classes = (AllowAny,)
        elif self.request.method == "GET" or self.request.method == "POST":
            self.permission_classes = (AllowAny,)
        else:
            self.permission_classes = (IsUserOrReadOnly,)
        return super(UserViewSet, self).get_permissions()