[MM3-users] Why is this Postorius API public?

Hello

I've just noticed that Postorius API is publicly accessible from the outside to an unauthenticated user, for example:

https://HOST/postorius/api/templates/list/LISTNAME.VHOST/list:member:regular...

Is this what is expected? Or a misconfiguration? How to fix this?

This is GNU Mailman 3.1.

Thanks!