TeamPass before 3.1.3.1 does not properly check whether a mailme (aka actionmail) operation is on behalf of an administrator or manager.