Channel access is enforced ONLY by the DataContainer voters ("NewsletterChannelAccessVoter" / "NewsletterRecipientsAccessVoter", requiring USER_CAN_EDIT_CHANNEL), whose "supportsType()" fires exclusively for Create/Read/Update/DeleteAction subjects dispatched inside DC_Table's create/edit/delete methods. The newsletter custom key-actions are dispatched directly by "Backend::getBackendModule()" (Backend.php:324-327) after only the module-level "USER_CAN_ACCESS_MODULE" check; the DC_Table constructor runs no per-record ReadAction vote for a key-action. "Newsletter.php" contains ZERO "isGranted" / "denyAccess" / "isAdmin" / "hasAccess" calls, and none of the newsletter DCAs have a "checkPermission" onload callback. ## Impact A channel-scoped newsletter editor can inject recipients into, mass-mail, and delete/denylist recipients of channels they are not authorized to edit - defeating the per-channel permission model (integrity + abuse of the mail-sending capability). ## Credits This security vulnerability was found by @HDWSec