My guess would be that someone took an internal tool with few security requirements and rolled it straight to production. If that is the case, this is probably

My guess would be that someone took an internal tool with few security requirements and rolled it straight to production. If that is the case, this is probably an excellent candidate for a security audit, there are almost certainly more issues if something this basic was not in place.