Rudder

System Rules, Directives, Groups can actually be modified, that shoud not happened.

While working on the API rest on Rules, i was able to Clone Root-DP Rule, to disable it, and they can be deleted.

I accessed the rule in the webapp (secure/configurationManager/ruleManagement#{"ruleId":"root-DP"}) and was able to do the same things.

this is happening in 2.3 too (by accessing secure/configurationManager/configurationRuleManagement#{"crId":"root-DP"})

Those actions should have been prevented by Rudder.