    def dispatch(self, request, *args, **kwargs):
        if (int(self.kwargs["user_id"]) == request.user.pk or
                request.user.has_perm("user.change_user")):
            if not self.user_allowed(request.user):
                return self.handle_no_permission(request)

            return super(OtpRequiredMixin, self).dispatch(request, *args, **kwargs)
        raise PermissionDenied
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.