This vulnerability occurs when a developer stores sensitive data in a private array, but then assigns a publicly accessible reference to that same array. This effectively makes all the private array's contents available to unauthorized code, bypassing intended access controls.
When you declare an array field as `private`, you're telling the system that external code shouldn't directly access it. However, if you then assign a public variable or return value to point to that same private array, you've created a backdoor. Any code with access to the public reference can now read, modify, or delete the supposedly private data, completely undermining your encapsulation. To prevent this, never expose references to your private arrays. Instead, return copies (defensive copies) of the array data or use immutable collections. Always validate that your getter methods or public fields don't provide direct access to mutable private objects, as this is a common oversight that leads to serious data exposure.
Impact: Modify Application Data
The contents of the array can be modified from outside the intended scope.
java