Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users

@@ -1,5 +1,9 @@
 # Release Notes for Craft CMS 4
 
+## Unreleased
+
+- Fixed a [moderate-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) access control vulnerability. (GHSA-6mrr-q3pj-h53w)
+
 ## 4.17.7 - 2026-02-24
 
 - The `PDO::MYSQL_ATTR_MULTI_STATEMENTS` attribute is now set to `false` by default for database connections.

@@ -32,6 +32,18 @@ class ConfigSyncController extends BaseUpdaterController
     public const ACTION_UNINSTALL_PLUGIN = 'uninstall-plugin';
     public const ACTION_INSTALL_PLUGIN = 'install-plugin';
 
+    protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_NEVER;
+
+    public function beforeAction($action): bool
+    {
+        if (!parent::beforeAction($action)) {
+            return false;
+        }
+
+        $this->requireAdmin(false);
+        return true;
+    }
+
     /**
      * Re-kicks off the sync, after the user has had a chance to run `composer install`
      *