Language: PHP
Label: vulnerable
CWE: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Code:
    public function move()
    {
        $task = $this->getTask();

        if ($this->request->isPost()) {
            $values = $this->request->getValues();
            list($valid, ) = $this->taskValidator->validateProjectModification($values);

            if ($valid && $this->taskProjectMoveModel->moveToProject($task['id'],
                                                                $values['project_id'],
                                                                $values['swimlane_id'],
                                                                $values['column_id'],
                                                                $values['category_id'],
                                                                $values['owner_id'])) {
                $this->flash->success(t('Task updated successfully.'));
                return $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('task_id' => $task['id'])));
            }

            $this->flash->failure(t('Unable to update your task.'));
        }

        return $this->chooseDestination($task, 'task_duplication/move');
    }