An improper access check allows unauthorized users to create custom fields via webservices endpoints.