The check_api_acls() function in Pagure's API returns immediately without performing any ACL validation when the requesting user has an active browser session. API endpoints protected by @api_login_required, including the project creation endpoint (POST /api/0/new) and a range of repository management endpoints, rely on this function for access control. As a result, any authenticated Fedora Account holder can invoke these privileged endpoints from a browser context, bypassing group membership requirements — specifically the packager group check enforced in REQUIRED_GROUPS — that would otherwise restrict access. This allows unauthorized creation of repositories under restricted namespaces such as rpms/, which Koji's SCM policy treats as trusted source locations. The fix adds REQUIRED_GROUPS validation to new_project() and ensures ACL checks are enforced regardless of session type.