PathixDataverse Forensics

← All 72 findings

Public exposure & Power Pages security

A Power Pages server logic endpoint that lets the caller pick the table

Severity Medium

What it is

Server logic takes the table it operates on from the caller.

Why it matters

The endpoint reads the Dataverse table it operates on out of the request instead of naming it in code, so it is not the narrow thing its name suggests. Whoever calls it chooses which table it touches.

This is the shape Microsoft's own documented sample uses, so it arrives in real sites by copy-paste rather than by design, and finding it says nothing about the care taken over the rest of the site. Table permissions still bound it, so it is not a route around your security model. What it means is that the endpoint's reach is defined by those permissions rather than by its code, and the practical consequence is that reviewing the endpoint is not enough: the table permissions on every web role that can invoke it are its real scope. It is also why Pathix cannot tell you which tables this endpoint writes to. There is no answer to read, because the answer is chosen at call time.

Find it yourself

Read each endpoint's code and follow where the table name comes from. A literal in the code is fine; a value pulled off the request body or query string is the finding. Downloading the site with the Power Platform CLI puts the server logic files on disk, which turns this into a text search rather than a click through every endpoint.

How to fix it

Name the table in the code, and add a separate endpoint per table if you need several. Where a caller-supplied table is genuinely required, validate it against an allowed list before it reaches the connector.

Related controls

SOC 2 CC6.3ISO 27001 A.8.2NIST AC-6

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

CMMC relevance

CMMC AC.L2-3.1.5

This condition produces evidence for AC.L2-3.1.5 (Level 2: employ least privilege, including for privileged accounts and security functions), for the Dataverse system in your assessment scope. Least privilege assumes you can state what a component reaches. An endpoint that takes its table from the request has no fixed answer to give: its scope is whatever the invoking web role's table permissions allow, chosen at call time by the caller. An assessor testing 3.1.5 here has to test those permissions rather than the endpoint, which is the finding's real content. Pathix cannot enumerate the tables involved and says so instead of presenting a partial list as the answer.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

Pathix checks this across every environment you scan, along with 71 other conditions. Self-hosted in your own Azure, read-only, metadata-only.

More in public exposure & power pages security

← Back to all 72 findings

© 2026 Pathix L.L.C. · self-hosted · metadata-only
Not affiliated with Microsoft. Dynamics 365, Dataverse, and Power Platform are trademarks of Microsoft Corporation.π