HRMS Portal » Sprint 1

Two expense endpoints are missing proper access control:

1. GET /get-expenses — returns the full company-wide expense list to any authenticated user, with no role check. It should be restricted to approvers/finance, but Employee tokens get the same data.
2. GET /get-my-expenses/:email — intended to return only the caller's own expenses, but the backend never verifies that the email in the URL belongs to the logged-in user (IDOR). Substituting any other employee's email returns their full expense history.