Description:
Admin dashboard can be opened directly via URL even when the user is logged out, exposing sensitive admin functions to unauthenticated users.
Steps to Reproduce:
- Go to the app and log out.
- In the browser address bar, navigate to /admin/dashboard.
- Observe that the page loads.
Expected Result:
User is redirected to the login page or shown an “Unauthorized” message.
Actual Result:
Admin dashboard loads with full access while user is not logged in.
Severity: High
Priority: P1
Status: New
Environment: Chrome 129, Windows 11
Screenshot / Evidence:
Description:
Admin dashboard can be opened directly via URL even when the user is logged out, exposing sensitive admin functions to unauthenticated users.
Steps to Reproduce:
Expected Result:
User is redirected to the login page or shown an “Unauthorized” message.
Actual Result:
Admin dashboard loads with full access while user is not logged in.
Severity: High
Priority: P1
Status: New
Environment: Chrome 129, Windows 11
Screenshot / Evidence: