The software does not perform an authorization check when an actor attempts to access a resource or perform an action.