Actions
Bug #5
open
SB
FU
Employee can view another employee's performance review
Bug #5:
Employee can view another employee's performance review
Start date:
Due date:
% Done:
0%
Estimated time:
Description
The /performance-by-email/:email endpoint has no ownership check or role restriction. Any authenticated user — including a low-privileged Employee — can request another employee's performance review data simply by passing that person's email in the URL.
Files
MA Updated by Miaki Admin 10 days ago
- Project changed from HRMS Portal to Sprint 3
MA Updated by Miaki Admin 10 days ago
- Project changed from Sprint 3 to Sprint 1
Actions