Bandyt/contao-forum — comment on commit 1fa8d7268c3b0af5222978517b35665b17110b2e
File: forum/forum_thread_editor.php line 127
By fbender:

You don't check whether the user is allowed to post Broadcasts / Announcements / etc. It's very easy to add arbitrary parameters to the POST request.

Needs additional checks in editor TPL. I'd include that ASAP and set the flag to true as long as you don't check for user privileges. You should do this for every privilege depending feature, just to make sure you won't forget the checks.