Fixed a security issue with admin scoping