fix access vulnerability