Wolf CMS through version 0.8.3.1 contains an authorization bypass vulnerability in the BackupRestoreController component. The flaw stems from a PHP operator precedence error in the permission check expression, causing incorrect evaluation of access control logic. Authenticated non-administrative users can exploit this to access restricted backup functionality. Attackers can create, download, and restore backups without requiring administrative privileges. The vulnerability is classified as an authorization bypass, allowing privilege escalation within the CMS. It affects all Wolf CMS installations up to and including version 0.8.3.1. The root cause is a logic flaw in PHP code rather than a missing check, making it a subtle but impactful security issue. No patch version is explicitly mentioned, suggesting users should review and update access control expressions manually or await an official fix.