ST-2026-209 · Authentication & identity
Cloudflare Access list views honor resource-scoped roles
Cloudflare changed Access resource listing on 19 August 2026 so members with only resource-scoped Access roles can open list pages and call list endpoints without an additional account-scoped read-only role.
Previous state
Members whose Access permissions were only resource-scoped could be blocked from Access list pages and receive 403 responses from list API endpoints unless they also had account-scoped read access.
Current state
Access list pages and API list endpoints return only the applications, policies, service tokens and identity providers included in the member's permission-policy scopes, without requiring extra account-wide read visibility.
Affected users
Who needs to care
Cloudflare Access administrators delegating management through resource-scoped roles and members operating under those scoped permissions.
Required response
What to do
Reassess permission policies that added broad account-read roles only to enable Access listing, and validate that scoped members now see exactly the intended resources.
Evidence boundary
What the source does not prove
The source proves scoped list visibility for Access resources. It does not grant account-wide visibility, and reusable policy visibility still depends on the specific Access Policy Admin scope described by Cloudflare.
Lifecycle history
Dated event sequence
- Resource-scoped Access list visibility becomes available
Cloudflare enabled scoped dashboard and API listing for Access resources without an additional account-level read role.
Evidence ledger
First-party sources
- 01Cloudflare — Access resource lists now support resource-scoped roles
Official Cloudflare changelog · 2026-08-19
Open official source ↗