                    elseif ($permission == $mergedPermission && $mergedPermissions[$permission] == 1) {
                        $matched = true;
                        break;
                    }
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.