CWE-566
Authorization Bypass Through User-Controlled SQL Primary Key
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
Impactr finds and proves whether CWE-566 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.