Access restrictons can be bypassed with redirections.
vulners.com/securityvulns/securityvulns:doc:21422