CWE-638
Not Using Complete Mediation
The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
Impactr finds and proves whether CWE-638 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.