A Power Pages server logic endpoint anyone can call
What it is
Server logic on this site can be run by anonymous visitors.
Why it matters
Server logic is JavaScript the site runs on the server, and this endpoint is granted to the web role flagged for anonymous users. Anyone who has not signed in can invoke it at /_api/serverlogics/<name>.
This does not mean the endpoint bypasses your security model. What it can reach in Dataverse is still bounded by the table permissions granted to that same web role. What it does mean is that code written for a specific purpose is reachable by the public, and any gap between what the code assumes about its caller and what an anonymous caller can actually send is exposed to the internet: a table or filter chosen from a query parameter, a request body written to Dataverse without validation, an external call whose destination or credentials come off the request. Plenty of anonymous endpoints are correct. A store locator or a published price list is meant to answer without a sign-in, so the finding is a prompt to confirm the intent rather than a verdict that the endpoint is wrong. As everywhere else on this page, Pathix reads the configuration and has not called the endpoint, and whether the site itself is publicly reachable is the one layer a scan cannot read.
Find it yourself
Portal Management app, open Server Logic and read the web roles granted on each record, then check which of those roles carries the anonymous users flag on the site. Read the flag rather than the role name: a role called Anonymous Users is not necessarily the one the site treats as anonymous, and one called something else may be. Verify from a private browser window with no session by calling /_api/serverlogics/<name> and seeing whether you get a result or a refusal.
How to fix it
Decide whether the endpoint is meant to be public. If it is not, replace the anonymous web role with one that requires sign-in; if it is, review the code for anything that trusts its caller.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for AC.L1-3.1.22 (Level 1: control information posted or processed on publicly accessible systems), for the Dataverse system in your assessment scope. 3.1.22 governs what a publicly accessible system is allowed to hold, and the question it usually asks is which pages and columns a visitor reaches. This is a different shape: an endpoint that runs code the organization wrote, started by a caller nobody authenticated. What that code can touch is still bounded by the table permissions on the same web role, so the finding is about who can invoke it rather than about what it gets away with once invoked. Pathix reads five of the six layers deciding site reach; site visibility is not readable by scan, so this is what the configuration grants rather than confirmed public reach.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 71 other conditions. Self-hosted in your own Azure, read-only, metadata-only.