Access control is only checked on application request.
vulners.com/securityvulns/securityvulns:doc:22185