A field-secured column a Power Pages site is set up to serve publicly
What it is
Portal is configured to serve a secured column to anonymous visitors.
Why it matters
A table permission grants anonymous Read, the Web API is enabled for the table, and the field list includes a column somebody deliberately secured. Together they configure the site to serve it to visitors who have not signed in.
This is configured exposure, not confirmed serving. Pathix reports what the settings and permissions say and has not issued the request. A secured column on an internal form is masked per user by Dataverse itself; the portal is different, because the classic runtime queries as an elevated application user rather than as the visitor, and which application user a site runs as is not attributable by a scan, so field-level security can neither be relied on to block the value nor be asserted to have failed. Page permissions do not enter into it: they gate which pages render, never the Web API, so restricting the site's pages does not close this path. Site visibility is the one layer of the six Pathix cannot read, and a private site neutralises the whole finding.
Find it yourself
Three places, and you need all three to line up. In the Portal Management app, Site Settings, find Webapi/<table>/enabled and Webapi/<table>/fields. Then check the table's secured columns under Field Security Profiles in the admin centre. Then read the table permissions for one granting Read to the role marked as the anonymous users role. Read those roles from the Portal Management app's own Table Permission form: on the enhanced data model the advertised role relationship accepts a write and then reads back empty, permanently, so checking it the obvious way will tell you there is no role attached when there is. Verify the whole thing from a private browser window with no session by requesting the column through the site's Web API.
How to fix it
Break the weakest link: drop the column from the field list, disable the table's Web API, or detach the anonymous role from the permission.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for AC.L2-3.1.22 (Level 1: control information posted or processed on publicly accessible systems) and AC.L2-3.1.5 (Level 2: employ least privilege, including for privileged accounts and security functions), for the Dataverse system in your assessment scope. A column somebody deliberately secured is configured to be served to visitors who have not signed in. Worth stating precisely what that does and does not mean: the classic portal runtime queries as an elevated application user rather than as the visitor, so field-level security can neither be relied on to stand between the configuration and the value nor be asserted to have failed. Pathix reports the configuration and has not issued the request.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 39 other conditions. Self-hosted in your own Azure, read-only, metadata-only.