Summary

Using only msg.sender would not provide the same level of control and security as Ownable does and

msg.sender can change during the execution of a transaction, potentially allowing unauthorized access

Vulnerability Details

Using Ownable in this way is not correct and msg.sender can be different values ​​during execution and it causes damage because any person may be able to put himself in the place of the owner. Therefore, it is better to fill this value in the constructor.

Impact

Unauthorized access to functions that only the owner can call

Tools Used

personal knowledge

Recommendations

To determine the owner, it is better to have a public variable that is filled in the constructor by msg.sender and is designated as the owner.

or you can use Ownable in constructor like this: