I've been running 23.05.2 for a while, but I recently upgraded to 23.05.3
Now if I try using 'Backup' in Luci to backup the config, I get a local 25 byte file with a .tar.gz name, only it's plain text of "Backup permission denied".
If I ssh in and manually run /www/cgi-bin/cgi-backup I get the same.
uhttpd process is being run by root.
To help someone in the future, the key is that the cgi-backup script will only work correctly from an HTTP POST method - if called from an HTTP GET it throws the "Backup permission denied" error.
What I was getting was that when asking Firefox to go to the router's hostname it first tried an HTTPS connection. The router replied but with a self-signed certificate - Firefox didn't like this, told me there was no secure connection, and asked if it should use an insecure connection (i.e. HTTP). When i replied yes, it made the connection but because it was using an insecure connection it turned all POST method requests into GET methods