HRMS Portal » Sprint 1

The /add-performance-review endpoint has no role restriction and no check on who is allowed to act as the reviewer. It only requires a valid login, not a specific role such as Manager or HR.

Because of this, a regular Employee can submit a performance review targeting any other employee, freely setting themselves (or anyone else) as the reviewerEmail. The backend trusts whatever reviewer identity is sent in the request body instead of deriving it from the authenticated session, and it never checks whether the caller actually has authority over the employee being reviewed.

In practice, this means any employee could fabricate a performance review — positive or negative — against a colleague, complete with ratings, comments, and an overall score, and it would be stored exactly as if a legitimate manager had submitted it. This undermines the integrity of the entire performance review system, since submitted reviews cannot be trusted to have come from an authorized reviewer.