HRMS Portal » Sprint 1

The /get-all-salaries endpoint has no permission check, allowing any low-privileged authenticated user to retrieve full salary details (basic salary, allowances, deductions, net salary) of every employee. Verified via both browser and script — expected 403 Forbidden, actual 200 OK with full compensation data returned. This is a serious confidentiality issue and should be restricted to authorized personnel only.