Actions
Bug #2
open
SB
FU
Employee can read another user's salary by supplying their email (GET /get-salary?email=)
Bug #2:
Employee can read another user's salary by supplying their email (GET /get-salary?email=)
Start date:
Due date:
% Done:
0%
Estimated time:
Description
The /get-salary endpoint fetches salary data based on an email query parameter, but never checks whether the requester is authorized to view that specific person's salary. A low-privileged authenticated user can simply pass any other employee's email address and receive that person's full salary breakdown, instead of being restricted to their own record.
Files
MA Updated by Miaki Admin 10 days ago
- Project changed from HRMS Portal to Sprint 3
MA Updated by Miaki Admin 10 days ago
- Project changed from Sprint 3 to Sprint 1
Actions