Missing Authorization (ARCH8120)

Key kotlin.security.missing-authorization · Severity warning · Category security · CWE CWE-862

Flags a @RestController with state-changing mappings and no @PreAuthorize / @Secured / @RolesAllowed anywhere in the class.

Incorrect

@RestController
class AdminController { @DeleteMapping("/users/{id}") fun delete(...) }

Correct

@RestController
@PreAuthorize("hasRole('ADMIN')")
class AdminController { ... }

Fix

Guard the class or each mutating action with an authorization annotation.