Language: Python
Label: vulnerable
CWE: CWE-693 \u2014 Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Code:
    def test_register_connector_template_wrong_scope(
        self,
        api_client: TestClient,
        register_connector_template_url,
        generate_auth_header,
        complete_connector_template,
    ):
        CONFIG.security.allow_custom_connector_functions = True
        auth_header = generate_auth_header(scopes=[CLIENT_READ])
        response = api_client.post(
            register_connector_template_url,
            headers=auth_header,
            files={
                "file": (
                    "template.zip",
                    complete_connector_template,
                    "application/zip",
                )
            },
        )
        assert response.status_code == 403