I checked them for you:
| CVE | without root password? |
|---|---|
| CVE-2023-47464 |  |
| CVE-2023-47463 |
 (when WebDAV is active, fixed in 4.5.0) |
| CVE-2023-50919 |
(fixed in 4.5.0) |
| CVE-2023-50920 |
(requires physical access) |
| CVE-2023-50921 |
(fixed in 4.5.0) |
| CVE-2023-46454 |
(requires upload of OpenVPN file) |
| CVE-2023-46455 |
(requires upload of OpenVPN file) |
| CVE-2023-46456 |
(requires upload of OpenVPN file) |
| CVE-2023-50922 |
(but not really, since you need to steal a Cookie before) |
Guess @alzhao can confirm this?