diff --git a/src/Core/Authorization/AuthorizationResolver.cs b/src/Core/Authorization/AuthorizationResolver.cs index 0f22b9cd28..2395eb13a4 100644 --- a/src/Core/Authorization/AuthorizationResolver.cs +++ b/src/Core/Authorization/AuthorizationResolver.cs @@ -128,9 +128,21 @@ public bool AreRoleAndOperationDefinedForEntity(string entityIdentifier, string return true; } } + + // If the role is not found or doesn't define the operation, + // fall back to the anonymous role's permissions + // since anonymous access implies the entity is publicly accessible. + if (valueOfEntityToRole.RoleToOperationMap.TryGetValue(ROLE_ANONYMOUS, out RoleMetadata? anonymousRoleMetadata)) + { + if (anonymousRoleMetadata!.OperationToColumnMap.ContainsKey(operation)) + { + return true; + } + } } + } - return false; +return false; } public bool IsStoredProcedureExecutionPermitted(string entityName, string roleName, SupportedHttpVerb httpVerb)