URL-based access control can be circumvented 1 URL-based access control can be circumvented 05/12/2024