CWE-1112 describes documentation that does not fully define the mechanisms that control or influence how a product's programs execute. MITRE's extended description lists the usual suspects: environment variables, configuration files, registry keys, command line switches or options, and system settings.
It is a quality issue with no direct security implications, and MITRE prohibits using it to map real vulnerabilities.
How it happens
Developers add a debug flag, a hidden environment variable or a config key while building a feature. It works, it is useful, and it never reaches the manual. Years later, nobody remembers it exists.
What an attacker gains
Not much directly. MITRE lists reduced maintainability and increased analytical complexity. The security angle is practical: an execution control that nobody has documented is one that nobody reviews, hardens or monitors.
How to find it
No detection methods are listed. Search the code for reads of environment variables, argument parsers, config loaders and registry access, then compare that list to the documentation.
How to fix it
The record has no formal mitigations. List every control that influences execution, with its default, valid values and effect. Mark any that change security behaviour, and review them as seriously as you review code.
Quick check
Why would a hidden config flag matter to security?
Because it can change behaviour in ways reviewers never examined. Documentation is how such controls get reviewed.
