I have a site that only allows specific users to access. However, if a user with no access goes directly to a list view page, they see the view (although it doesnt actually show any of the list items). If they go to the homepage of the site, they get the expected access denied.
I suspect this is due to NT AUTHORITY\authenticated users existing in Style Resource Readers. Why does this allow list views to be seen?