The product, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.