Default installation configuration allows anonymous access to some admin configuration

When creating a new Gradle Enterprise installation without specifying an initial configuration file, the default access control settings allow anonymous access to build cache administration and the Export API. This is different to the intended and documented default configuration, which is to only allow viewing and publishing of build scans by anonymous users.

In particular, build cache administration should be restricted to trusted users. An attacker may achieve remote code execution (RCE) by changing the build cache access control settings to allow them to store malicious software in the cache.

As of Gradle Enterprise 2022.1 the anonymous user access control settings are aligned with the documented defaults, disallowing modifying build cache configuration.