Scan rule · RSC-SEC-071
Table fully readable by any signed-in user
SecuritySeverity: MediumCWE-639OWASP A01-2021
Reports tables hidden from anonymous callers but fully visible to a freshly created stranger account — intended for catalogue data, the same flaw otherwise.
Scan tier
Active (after domain proof)
How to fix it
Decide per table whether “all signed-in users” is the right audience; otherwise restrict to the owner.