The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
1
cwe_id
642
name
External Control of Critical State Data
description
The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.