Rule Definition
When using APIs that enable impersonation of a client, be sure to revert to the original identity. For example, when using the WindowsIdentity and WindowsImpersonationContext, use the C# using statement or the Visual BasicUsing statement, as shown in the following code. The WindowsImpersonationContext class implements the IDisposable interface, and therefore the common language runtime (CLR) automatically reverts to the original identity once the code leaves the using block.

Remediation
Review the source code and revert after impersonation.

Violation Code Sample

WindowsIdentity identity = ServiceSecurityContext.Current.WindowsIdentity;
identity.Impersonate()
{
    // Run code under the caller's identity.
}

Fixed Code Sample

WindowsIdentity identity = ServiceSecurityContext.Current.WindowsIdentity;
using (identity.Impersonate())
{
    // Run code under the caller's identity.
}

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/best-practices-for-security-in-wcf https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control