The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
An adversary could read or modify data, depending on how the resource is intended to be used.
An adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms.