Actions
Bug #6
open
SB
FU
Broken Access Control — Employee can view other employees' expense records
Bug #6:
Broken Access Control — Employee can view other employees' expense records
Start date:
Due date:
% Done:
0%
Estimated time:
Description
Two expense endpoints are missing proper access control:
- GET /get-expenses — returns the full company-wide expense list to any authenticated user, with no role check. It should be restricted to approvers/finance, but Employee tokens get the same data.
- GET /get-my-expenses/:email — intended to return only the caller's own expenses, but the backend never verifies that the email in the URL belongs to the logged-in user (IDOR). Substituting any other employee's email returns their full expense history.
Files
Actions