--- title: "Admin pages open to anyone with the link" description: "Browser-only checks hide the menu but not the data. How to test your admin pages while logged out and get real server and database checks in place." url: https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts) # Admin pages open to anyone with the link VC-27 · Lovable · v0 · Bolt · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict Get an engineer for this one. Needs server-side checks across routes and data. - **How serious**: Critical - **Fix it yourself?**: No, get an engineer - **Typical cost**: €99–$990 per fix, or $1,500–$15,000 for a full cleanup ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated for Lovable**: [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 **What you see.** Anyone who types /admin into the address bar sees your dashboard, user list, or settings without logging in. ## Why it happens AI builders protect pages in the browser. The code checks whether the user looks like an admin and hides the menu or redirects. That is a cosmetic check. The page's code and the data it loads are still sent to anyone who asks, because the browser is under the visitor's control. The Next.js documentation says client-side UI restrictions alone are not sufficient for security, that returning null in a layout is not recommended, and that server actions and route handlers must be treated like public API endpoints and verify the user themselves. On Lovable and Bolt the same applies through Supabase. An admin table with no row-level security policy, or a policy that only checks the user is logged in, lets every signed-in user read it. Our checklist calls this DATA-05, admin actions are checked on the server. Hidden buttons do not count, and neither does a redirect that fires after the data has already loaded. ## Fix it yourself 1. Log out, open a private window, and type each admin address directly. Note every page that loads or shows data. 2. In Supabase, open **Table Editor**, pick each admin table, and read its policies. A policy whose condition is simply `true` means anyone can read. 3. Ask the agent to add a `role` or `is_admin` column and policies that check it with `(select auth.uid())`, and to repeat the check inside every server action, route handler, and edge function. 4. Ask it to remove admin-only logic from the browser code and move it to the server, so the browser only receives what the user is allowed to see. 5. Repeat step 1 as a normal user and as a logged-out visitor after each change. ## When to get an engineer Get an engineer now if real customers already use the app, since a visitor may already have read admin data. Tell them which pages opened without login, which builder you used, and whether you use Lovable Cloud or your own Supabase. One fix runs €99–$990, but admin leaks usually sit next to other access problems, so a cleanup and hardening pass at $1,500–$15,000 over 1–8 weeks is common. Start with [what to do about a data leak](https://whocanfixmyapp.com/data-leak). ## Top-rated companies for Lovable apps Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 · Best for: A check before launch · Free first step · from $49 - 2 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 3 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 [All 59 Lovable companies, ranked](https://whocanfixmyapp.com/best/lovable-developers) ## Check these DATA-05 · High Admin actions are checked on the server Hiding an admin button is not protection. Call the admin endpoint as a normal user and confirm it is refused. DATA-01 · Critical Access rules are on for every table In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say `allow read, write: if true`. DATA-03 · Critical One user cannot open another user's records Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result. AUTH-02 · High Signing out really ends the session Sign out, press Back, and refresh. You should not see private pages or data. ## Questions ### The admin page redirects me to login, so isn't it protected? Not if the redirect runs in the browser. The page code and its data requests still reach the visitor first. Protection has to happen on the server and in the database policies. ### Is this the same problem as the Lovable CVE? It is a close relative. CVE-2025-48757 was about tables readable without proper row-level security. Open admin pages are the same gap seen from the screen instead of the database. Sources: [Next.js: Authentication guide](https://nextjs.org/docs/app/guides/authentication); [Supabase: Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security); [Statement on CVE-2025-48757](https://mattpalmer.io/posts/statement-on-CVE-2025-48757/). **Lovable guide** What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable). **Same category** - [Users can't log in on the live site](https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site) - [Google sign-in fails with redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch) - [Confirmation and password-reset emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive) - [Users get logged out when they refresh the page](https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh) - [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data) - [Supabase says "new row violates row-level security policy"](https://whocanfixmyapp.com/problems/supabase-rls-blocking-insert) [All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.