Table fully readable by any signed-in user
Scan rule · RSC-SEC-071
- Security
- Severity: Medium
- CWE-639
- OWASP A01-2021
Reports tables hidden from anonymous callers but fully visible to a freshly created stranger account — intended for catalogue data, the same flaw otherwise.
Scan tier
- Active (after domain proof)
How to fix it
Decide per table whether “all signed-in users” is the right audience; otherwise restrict to the owner.