func (svc *Service) MacadminsData(ctx context.Context, id uint) (*fleet.MacadminsData, error) {
	if !svc.authz.IsAuthenticatedWith(ctx, authz_ctx.AuthnDeviceToken) {
		if err := svc.authz.Authorize(ctx, &fleet.Host{}, fleet.ActionList); err != nil {
			return nil, err
		}

		host, err := svc.ds.HostLite(ctx, id)
		if err != nil {
			return nil, ctxerr.Wrap(ctx, err, "find host for macadmins")
		}

		if err := svc.authz.Authorize(ctx, host, fleet.ActionRead); err != nil {
			return nil, err
		}
	}

	var munkiInfo *fleet.HostMunkiInfo
	switch version, err := svc.ds.GetMunkiVersion(ctx, id); {
	case err != nil && !fleet.IsNotFound(err):
		return nil, err
	case err == nil:
		munkiInfo = &fleet.HostMunkiInfo{Version: version}
	}

	var mdm *fleet.HostMDM
	switch enrolled, serverURL, installedFromDep, err := svc.ds.GetMDM(ctx, id); {
	case err != nil && !fleet.IsNotFound(err):
		return nil, err
	case err == nil:
		enrollmentStatus := "Unenrolled"
		if enrolled && !installedFromDep {
			enrollmentStatus = "Enrolled (manual)"
		} else if enrolled && installedFromDep {
			enrollmentStatus = "Enrolled (automated)"
		}
		mdm = &fleet.HostMDM{
			EnrollmentStatus: enrollmentStatus,
			ServerURL:        serverURL,
		}
	}

	if munkiInfo == nil && mdm == nil {
		return nil, nil
	}

	data := &fleet.MacadminsData{
		Munki: munkiInfo,
		MDM:   mdm,
	}

	return data, nil
}
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.