Why security hole in ACL?