Custom backend module "key" actions are dispatched in "Backend::getBackendModule()" (Backend.php:322-327) after only the module-level "USER_CAN_ACCESS_MODULE" check - no per-record voter runs. ## Impact A non-admin editor scoped to certain pages/forms can overwrite the tableitems/listitems/options of arbitrary tl_content / tl_form_field records outside their scope, defeating the per-record access control. Integrity IDOR (blind content overwrite; the value written is "serialize()" of a plain string array from the CSV - not object injection). ## Credits This security vulnerability was found by @HDWSec