Language: TypeScript
Label: vulnerable
CWE: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.

Code:
  markClaimed: async function (inviteId = null, user) {
    const invite = await this.get(`id = ${inviteId}`);
    if (!invite) return { success: false, error: "Invite does not exist." };
    if (invite.status !== "pending")
      return { success: false, error: "Invite is not in pending status." };

    const db = await this.db();
    const { success, message } = await db
      .run(`UPDATE ${this.tablename} SET status=?,claimedBy=? WHERE id=?`, [
        "claimed",
        user.id,
        inviteId,
      ])
      .then(() => {
        return { success: true, message: null };
      })
      .catch((error) => {
        return { success: false, message: error.message };
      });

    db.close();
    if (!success) {
      console.error(message);
      return { success: false, error: message };
    }

    return { success: true, error: null };
  },