It is possible to perform alarms/notifications actions through the Acks ReST end point without permissions

In order to acknowledge, unacknowledge, clear or escalate alarms (and something similar for ack/unack notifications), the user requires appropriate permissions.

In fact, the ReST end-points for alarms enforce this and return permission denied if the user cannot perform the action.

Unfortunately, this is not the case when someone perform the same goal through /acks (instead of /alarms).

Besides that, the user that appeared on the action is "admin", and not the actual user who requested the change.