CWE-372
Incomplete Internal State Distinction
The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
Impactr finds and proves whether CWE-372 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.