The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
