AIKIDO-2026-749901

TL;DR

RailsAdmin's JSON and XML output is not limited to fields configured for the model. The request's schema parameter is passed directly into to_json or to_xml, so names in schema[methods] or schema[include] run on every exported record, including state changing methods such as destroy, while schema[only] exposes fields excluded from the export configuration. JSON and XML responses from the index and show actions contain every record attribute regardless of the configured fields. The fix builds the JSON and XML schema from the relevant section's configured fields and rejects schema keys outside that allowlist.