A Power Pages server logic endpoint that lets the caller pick the table
What it is
Server logic takes the table it operates on from the caller.
Why it matters
The endpoint reads the Dataverse table it operates on out of the request instead of naming it in code, so it is not the narrow thing its name suggests. Whoever calls it chooses which table it touches.
This is the shape Microsoft's own documented sample uses, so it arrives in real sites by copy-paste rather than by design, and finding it says nothing about the care taken over the rest of the site. Table permissions still bound it, so it is not a route around your security model. What it means is that the endpoint's reach is defined by those permissions rather than by its code, and the practical consequence is that reviewing the endpoint is not enough: the table permissions on every web role that can invoke it are its real scope. It is also why Pathix cannot tell you which tables this endpoint writes to. There is no answer to read, because the answer is chosen at call time.
Find it yourself
Read each endpoint's code and follow where the table name comes from. A literal in the code is fine; a value pulled off the request body or query string is the finding. Downloading the site with the Power Platform CLI puts the server logic files on disk, which turns this into a text search rather than a click through every endpoint.
How to fix it
Name the table in the code, and add a separate endpoint per table if you need several. Where a caller-supplied table is genuinely required, validate it against an allowed list before it reaches the connector.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for AC.L2-3.1.5 (Level 2: employ least privilege, including for privileged accounts and security functions), for the Dataverse system in your assessment scope. Least privilege assumes you can state what a component reaches. An endpoint that takes its table from the request has no fixed answer to give: its scope is whatever the invoking web role's table permissions allow, chosen at call time by the caller. An assessor testing 3.1.5 here has to test those permissions rather than the endpoint, which is the finding's real content. Pathix cannot enumerate the tables involved and says so instead of presenting a partial list as the answer.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 71 other conditions. Self-hosted in your own Azure, read-only, metadata-only.