No caching just means the HTML is cached on the edge. It’s bad but it’s not that bad. Nobody can do anything because of lack of tokens or auth cookies. But they can read internal admin pages and sensitive information. You basically have cloudflare in front of your server and when admin pages are cached by cloudflare when somebody logs in, the pages are also cached and everybody can read them.