Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. Files may be served with the `Cache-Control: public` HTTP header when they should be uncacheable, potentially allowing users to access cached versions of files containing information they are not authorized to see. This occurs when a more-privileged user has previously requested the file and it remains in the cache.