CWE-402
Transmission of Private Resources into a New Sphere ('Resource Leak')
The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
Impactr finds and proves whether CWE-402 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.