CWE-412
Unrestricted Externally Accessible Lock
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
Impactr finds and proves whether CWE-412 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.