Affected versions of Winter CMS did not enforce the ImportExportController behavior granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the import[permissions] and export[permissions] configuration keys enforced by userHasAccess(), but that check was applied only to the import() and export() page actions. Backend\Classes\Controller::execAjaxHandlers() dispatches AJAX handlers and returns before execPageAction() runs, and the behavior binds its import and export form widgets in its constructor on every request, so an authenticated backend user without the configured permission could invoke the import and export AJAX handlers directly. Fixed in v1.2.14.