Language: JavaScript
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
exports.handler = async ({ arguments: args }, context) => {
    if (!args)
        return respondWithError("Internal error while trying to execute account task.", "Event arguments missing.");
    if (!args.action)
        return respondWithError("Internal error while trying to execute account task.", "Parameter 'action' missing.");

    let params;
    if (args.paramJson) {
        try {
            params = JSON.parse(args.paramJson);
        } catch (e) {
            return respondWithError("'paramJson' contains malformed JSON string.");
        }
    }

    try {
        switch (args.action) {
            case "listAccounts":
                return listAccounts(context);
            case "updateAccount":
                return updateAccount(params);
            case "registerAccount":
                return registerAccount(params);
            case "removeAccount":
                return removeAccount(params);
            default:
                throw new Error("unknown API action '" + args.action + "'");
        }
    } catch (error) {
        return respondWithError("Internal error while trying to execute account task.", error);
    }
};