Exposure of Data Element to Wrong Session

This flaw typically happens when application components, like singleton objects or pooled resources, are incorrectly used to store user-specific data. For instance, in Java Servlets, a single instance often handles requests for all users simultaneously. If a developer stores user data in the Servlet's member fields instead of the proper request or session scope, one user's data can become visible to another user, creating a race condition. To prevent this, always store user state in the appropriate session context (like `HttpSession`) or within local method variables, never in shared object fields. Ensure your design clearly separates per-request data from shared application data, and understand the threading model of your framework's components.