CWE-921
Storage of Sensitive Data in a Mechanism without Access Control
The product stores sensitive information in a file system or device that does not have built-in access control.
Impactr finds and proves whether CWE-921 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.