---
schema_version: "1"
id: 7deb86c3796a385d5268811b0686fd270508fd39f1bbdee5549ffdd07838980f
title: Avoid a Potential Security Vulnerability
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-community-manager/troubleshooting-avoid-a-potential-security-vulnerability.md
canonical_url: https://docs.mulesoft.com/api-community-manager/troubleshooting-avoid-a-potential-security-vulnerability
source_site: docs.mulesoft.com
content_type: documentation
content_hash: c6dda0ce3e73cd8a9e386b59e8c76faebb794ce58ff0e1ede9cecc1617c926e7
description: MuleSoft Documentation Site
latest: true
---
---
product: API Community Manager
---

# Avoid a Potential Security Vulnerability

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The guest and member user profile contains the Exchange Viewer permission that gives access to all
assets in Exchange with this visibility. An impersonated user can potentially exploit this
visibility and access assets that are not intended for them.

To troubleshoot this issue, ensure that guest and community users can only access intended and
required assets.

1.  Create a new team in Access Management called Guest Community Users and create a new mapping for
    External Idp Groups called Community Guest.

2.  In Salesforce, change the Named Credential authentication information.

3.  In Exchange, share the assets for the Everyone visibility with the Guest Community Users team
    and share assets for the Members only visibility with the Community Users team.

4.  In Access Management, remove the Exchange Viewer permission and the inherited permissions of the
    guest user and the Community Users team.

To avoid a potential security vulnerability:

1.  Create a new team in Access Management called Guest Community Users and create a new mapping for
    External Idp Groups called Community Guest:

    1.  Go to Access Management.

    2.  In the Access Management navigation menu, click **Teams**.

    3.  Click **Create Team** and enter `Guest Community Users`.

    4.  Select **External Idp Groups** and enter the following fields:

        - In **Group Name**, enter `Community Guest`.

        - In **Provider Name**, select a provider.

    5.  Click **Save Changes**.

2.  In Salesforce, change the Named Credential authentication information:

    1.  Go to **Salesforce > \*Setup**.

    2.  In the **Quick Find** search box, enter `Named Credentials` and select it.

    3.  Click **Anypoint**.

    4.  In the **Authentication** section, go to the **Per User Subject** field.

    5.  In the **Formula Editor** field change `& "|[\"Community User\"]"` to
        `& "|" & IF($User.Alias = "guest", "[\"Community Guest\"]", "[\"Community User\"]")`.

    6.  Click **Save**.

3.  In Exchange, share the asset with the Guest Community Users or the Community Users team. Repeat
    these steps for each asset you want to share with guest community users or the community users:

    1.  Go to Exchange and select the asset.

    2.  Click **Share**.

    3.  In the **Collaborators** tab, enter `Guest Community Users` or `Community Users`.

    4.  Click **Save**.

4.  In Access Management, remove the ability for users to see the inherited permissions from the
    Exchange Viewer permission:

    1.  Go to **Access Management > Users**.

    2.  Select the guest user.

    3.  In **Permissions**, move the slider to disable showing inherited permissions.

    4.  Click **Permissions > Remove all permissions**.

## See Also

- [Known Issues](https://help.salesforce.com/s/issues)