wooAttendees accessible without auth!

[sn3h]

Hi, I am not sure if I am doing everything right, but it seems to me that Attendees are accessibel without any authorization with graphql.

For example:

orders{
nodes{
total
date
status
billing {
... all fields
}
}
}

returns "orders": {
"nodes": []
},

but

wooAttendees(first:100) {
edges{
node{
id
title
order{
total
date
status
billing {
... all fields
}

returns all the data even to anonymous user. This has to be private and accesibel only after authorization.

Is there some way to set this up? thanks