Bug
By default, anonymous users can upload files to the "/server/rest/services/Hosted/<FeatureService>/FeatureServer/uploads/upload" API when the feature service is shared publicly.
| Bug ID Number | BUG-000175606 |
|---|---|
| Submitted | April 4, 2025 |
| Last Modified | July 21, 2025 |
| Applies to | ArcGIS GIS Server |
| Version found | 11.4 |
| Operating System | Windows Server |
| Operating System Version | 2022 |
| Status | In Review |
Workaround
In order to disable anonymous users from uploading files to a publicly shared feature service, the capability must be removed in the "/server/admin/services/Hosted/<Feature Service Name>.FeatureServer/edit" JSON.
By Default these are the allowed capabilities: ""capabilities": "Query,Create,Update,Delete,Editing,Uploads","
Steps to Reproduce
Bug ID: BUG-000175606
Software:
- ArcGIS GIS Server
Get notified when the status of a bug changes
Discover more on this topic
Search for related information
Find training related to this topic
Explore ideas and give feedback
Get help from ArcGIS experts
Download the Esri Support App