  }

  actionItems() {
    let composing = new PrivateComposing(this.user);

    const items = new ItemList();

    if (app.session.user && app.forum.attribute('canStartPrivateDiscussion')) {
      items.add('start_private', composing.component());
    }

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.