The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
CWE-284