CWE-271
Privilege Dropping / Lowering Errors
The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
Impactr finds and proves whether CWE-271 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.