Actions
Bug #3
open
SB
Broken Access Control — Employee role can onboard/create new users (POST /api/onboard-req)
Bug #3:
Broken Access Control — Employee role can onboard/create new users (POST /api/onboard-req)
Status:
New
Priority:
Normal
Assignee:
-
Start date:
Due date:
% Done:
0%
Estimated time:
Description
The /api/onboard-req endpoint, used to initiate onboarding for a new employee, has no role-based authorization check. Any authenticated user — including a low-privileged Employee — can call this endpoint with an arbitrary name/email and successfully create a new pending user/onboarding record, a capability that should be restricted to HR/Admin only.
Files
MA Updated by Miaki Admin 10 days ago
- Project changed from HRMS Portal to Sprint 3
MA Updated by Miaki Admin 10 days ago
- Project changed from Sprint 3 to Sprint 1
Actions