CWE-425
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Impactr finds and proves whether CWE-425 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.