Skip to content

Server Action without an access check

Scan rule · RSC-SEC-058

  • Security
  • Severity: High
  • CWE-862
  • OWASP A01-2021

Inspects the body of every `"use server"` function that writes to the database and reports a missing identity check — server actions are public endpoints.

Scan tier

  • Source code from source maps
  • Repo access (deep scan)

How to fix it

Load the user at the top of every action, check the role, and bail out when missing.

Scan your own app for free

More rules in this dimension