Actions
Bug #2
open
SB
FU
Employee can read another user's salary by supplying their email (GET /get-salary?email=)
Bug #2:
Employee can read another user's salary by supplying their email (GET /get-salary?email=)
Start date:
Due date:
% Done:
0%
Estimated time:
Description
The /get-salary endpoint fetches salary data based on an email query parameter, but never checks whether the requester is authorized to view that specific person's salary. A low-privileged authenticated user can simply pass any other employee's email address and receive that person's full salary breakdown, instead of being restricted to their own record.
Files
Actions