    public function beforeAction($action)
    {
        // Bypass when not installed for installer
        if (empty(Yii::$app->params['installed']) &&
                  Yii::$app->controller->module != null &&
                  Yii::$app->controller->module->id == 'installer') {
            return true;
        }

        $this->handleDeprecatedSettings();
        $this->controllerAccess = $this->getControllerAccess($this->rules);

        if (!$this->controllerAccess->run()) {
            if (isset($this->controllerAccess->codeCallback) &&
                method_exists($this, $this->controllerAccess->codeCallback)) {
                // Call a specific function for current action filter,
                // may be used to filter a logged in user for some restriction e.g. "must change password"
                call_user_func([$this, $this->controllerAccess->codeCallback]);
            } else if ($this->controllerAccess->code == 401) {
                $this->loginRequired();
            } else {
                $this->forbidden();
            }
            return false;
        }

        return parent::beforeAction($action);
    }
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.