GHSA-rvmm-v933-jgxq: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData() at /actions/charts/get-new-users-data is missing a requirePermission('viewUsers') authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.

The viewUsers permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base accessCp check inherited from the framework.

Each call returns the total count of users who joined the specified group in the requested period.