From the kcfinder website:
By default KCFinder is disabled. If you just set this setting to false all public visitors can upload and manage files on your web site. It is recommended to override this setting with sesssion configuration so only authenticated users can use KCFinder.