Language: TypeScript
Label: vulnerable
CWE: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Code:
                    paramJson: JSON.stringify({
                        budgetAmount: parseInt(budgetAmount),
                        expiresOn,
                        principalId,
                        budgetNotificationEmails,
                        user,
                        budgetCurrency: config.BUDGET_CURRENCY
                    })
                })
            ).then((response) => {