Language: JavaScript
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
const updateAccount = ({ id, accountStatus, adminRoleArn }) => {
    if (!id) return respondWithError("Internal error while trying to update account.", "Parameter 'id' missing.");
    if (!accountStatus)
        return respondWithError("Internal error while trying to update account.", "Parameter 'accountStatus' missing.");
    if (!adminRoleArn)
        return respondWithError("Internal error while trying to update account.", "Parameter 'adminRoleArn' missing.");
    let ddb = new AWS.DynamoDB.DocumentClient({
        region: region
    });
    return ddb
        .update({
            TableName: accountsTable,
            Key: {
                Id: id
            },
            UpdateExpression: "set AccountStatus = :s, AdminRoleArn=:r",
            ExpressionAttributeValues: {
                ":s": accountStatus,
                ":r": adminRoleArn
            },
            ReturnValues: "UPDATED_NEW"
        })
        .promise()
        .then((response) =>
            respondWithSuccess("DynamoDB table record for account " + id + " successfully updated.", response)
        )
        .catch((error) =>
            respondWithError("Error trying to update DynamoDB table record for account " + id + ".", error)
        );
};