Missing Authentication for Critical Functions

Exploit a missing server-side authentication check on a critical function in an Internet-facing application or service. Depending on the function, unauthenticated access can expose or change sensitive data or grant the privileges of that function. Limit this T1190-mapped procedure to services reachable from the Internet; internal-only instances are not external. Confirm that anonymous access is not an intended contract, and do not treat an HTTP success status alone as proof.