Admin area reachable anonymously
Scan rule · RSC-SEC-027
- Security
- Severity: High
- CWE-306
- OWASP A01-2021
Requests discovered admin paths anonymously and reports content instead of a redirect to sign-in.
Scan tier
- External scan (anonymous)
How to fix it
Move the server-side access check in front of rendering (middleware or layout guard).