> The normal way I use machines these days is that anyone with login access has some ability to become root. That is good, but you don't necessarily need login

> The normal way I use machines these days is that anyone with login access has some ability to become root. That is good, but you don't necessarily need login access to exploit this. You could exploit it via an RCE vulnerability in some other program, like the HTTP server or NTP client.