The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.