CWE-529
Exposure of Access Control List Files to an Unauthorized Control Sphere
The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
Impactr finds and proves whether CWE-529 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.