Language: JavaScript
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
const deleteLease = ({ accountId, principalId, user }) => {
    if (!principalId)
        return respondWithError("Internal error while trying to delete lease.", "Parameter 'principalId' missing.");
    if (!accountId)
        return respondWithError("Internal error while trying to delete lease.", "Parameter 'accountId' missing.");
    if (!user) return respondWithError("Internal error while trying to delete lease.", "Parameter 'user' missing.");
    const ddb = new AWS.DynamoDB.DocumentClient({
        region: region
    });
    return ddb
        .delete({
            TableName: leasesTable,
            Key: {
                AccountId: accountId,
                PrincipalId: principalId
            }
        })
        .promise()
        .then((response) => respondWithSuccess("Lease for " + user + " successfully deleted.", response))
        .catch((error) => respondWithError("Error trying to delete lease for " + user + ".", error));
};