Actions
Bug #4
open
SB
FU
Broken Access Control — Employee can view all employees' leave requests (GET /get-leaves)
Bug #4:
Broken Access Control — Employee can view all employees' leave requests (GET /get-leaves)
Start date:
Due date:
% Done:
0%
Estimated time:
Description
The /get-leaves endpoint, which lists leave requests, has no role-based authorization or ownership scoping. Any authenticated user — including a low-privileged Employee — can call this endpoint and see the leave applications of every employee in the company, not just their own.
Files
Actions