diff --git a/backend/src/routes/cockpit.ts b/backend/src/routes/cockpit.ts
index 1e09fae..aa8525c 100644
--- a/backend/src/routes/cockpit.ts
+++ b/backend/src/routes/cockpit.ts
@@ -1,6 +1,7 @@
 import { Router, Request, Response } from 'express';
 import { PrismaClient } from '@prisma/client';
 import { PaymentService } from '../modules/banking/paymentService';
+import { requireAuth } from '../middleware/auth';
 
 const prisma = new PrismaClient();
 const paymentService = new PaymentService(prisma);
@@ -8,7 +9,8 @@ const paymentService = new PaymentService(prisma);
 /** Router für das Vermieter-Cockpit-Dashboard (aggregierte Übersichtsdaten). */
 export const cockpitRouter = Router();
 
-cockpitRouter.get('/cockpit/summary', async (_req: Request, res: Response) => {
+// Erfordert Login: sensible Miet- und Kontaktdaten dürfen nicht öffentlich sein.
+cockpitRouter.get('/cockpit/summary', requireAuth, async (_req: Request, res: Response) => {
   const [trafficLights, openTickets, rooms] = await Promise.all([
     paymentService.getRentTrafficLights(),
     prisma.ticket.findMany({