AGENTFORCE-APEX-04: Exposed Apex Query or DML Without CRUD/FLS Enforcement
🟡 Medium · Broken Access Control
Detects @AuraEnabled, @InvocableMethod, @RemoteAction and REST Apex whose SOQL, dynamic queries or DML run in system mode with no CRUD/FLS enforcement on the path (WITH USER_MODE / SECURITY_ENFORCED, AccessLevel.USER_MODE, 'as user', stripInaccessible, Schema describe checks or an access-check helper). 'with sharing' does not apply object or field permissions. One finding per class; medium, high when the class is enabled for a guest profile.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-APEX-04 |
| Severity | Medium |
| Category | Broken Access Control |
| Compliance | SOC2_CC6, HIPAA |
Remediation
Add WITH USER_MODE to SOQL (or WITH SECURITY_ENFORCED), pass AccessLevel.USER_MODE to Database.query / countQuery / getQueryLocator and Database DML, use 'insert as user' / 'update as user', or filter results with Security.stripInaccessible. A Schema describe check (isAccessible/isCreateable/isUpdateable) or a shared access-check helper on the path also satisfies the rule. Keep 'with sharing' for record visibility.