A Power Pages Web API configured with a wildcard field list

Portal Web API serves every column of this table.

The Web API is enabled for this table with a wildcard field list, so every column, including any that are field-secured, is in the set the site will serve to the browser.

The Web API is a direct query channel and does not depend on any page displaying the data, so a visitor who never sees a list page can still request these columns if a table permission admits them. That is also the boundary: the field list decides what the channel can serve, and table permissions decide who it serves. This only ever fires on explicit configuration, because the platform default leaves a table's Web API disabled. Portal column permissions can narrow what the channel returns and Pathix reads them; site visibility is the one layer not readable by an unattended scan, and a private site walls the whole thing.

Portal Management, Site Settings, look for Webapi/<table>/enabled and Webapi/<table>/fields. A fields value of * is the finding. This one only ever fires on explicit configuration, because the platform default leaves a table's Web API disabled, so an absent setting means the channel is off. Verify from a private browser window by requesting a column you removed and confirming the API refuses it.

Replace the wildcard with the explicit list of columns the site's pages and scripts actually use, keeping secured columns off it.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for AC.L2-3.1.22 (Level 1: control information posted or processed on publicly accessible systems) and AC.L2-3.1.5 (Level 2: employ least privilege, including for privileged accounts and security functions), for the Dataverse system in your assessment scope. A wildcard column list means every column of the table is in the set the site will serve, including any that are field-secured, which is the 3.1.5 half of this. Pathix reports the configured list; site visibility remains unreadable by scan, so this is configured reach rather than confirmed serving.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A field-secured column a Power Pages site is set up to serve publicly
• A Power Pages table permission letting anonymous visitors write
• A Power Pages table permission granting anonymous read
• A Power Pages site with open self-registration