A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.
CWE-862