Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token.