It's a write that shouldn't be authorized but was. It's an access control vulnerability, and they happen all the time.