Fixes GHSA-62j4-hvj7-px3f

app/controllers/admin/base_controller.rb

@@ -4,6 +4,7 @@ module Admin
   class BaseController < ApplicationController
     include Authorization
     include AccountableConcern
+    include Admin::PermissionsConcern
 
     content_security_policy do |p|
       policy = ContentSecurityPolicy.new
@@ -13,7 +14,6 @@ module Admin
 
     layout 'admin'
 
-    before_action :require_moderator_or_admin_permissions
     before_action :set_referrer_policy_header
 
     after_action :verify_authorized
@@ -27,10 +27,5 @@ module Admin
     def set_user
       @user = Account.find(params[:account_id]).user || raise(ActiveRecord::RecordNotFound)
     end
-
-    def require_moderator_or_admin_permissions
-      # not using #authorize here, so #verify_authorized still makes sure more fine-grained rules are enforced down the line
-      forbidden unless Admin::BasePolicy.new(current_account, :base).access?
-    end
   end
 end