Project

General

Profile

Actions
Copy link

Gaps #93910

open

Master > PMS Master > StaffMaster. Unauthorized Access to Inactivate Employee Account via Direct URL in PMS Master Module

Added by Nur'Ain Binti Karim 5 months ago. Updated 2 months ago.

Status:
QA
Priority:
Critical
Assignee:
Mangesh Pangrekar
Category:
MedCare
Target version:
-
Start date:
04/06/2026
Due date:
% Done:

0%

Estimated time:
Dev Due date:
12/08/2026
Release date to QA:
13/08/2026
Issue released on:
HUMS SandBox
Function:
HUMS

Description

Issues Description:
Master > PMS Master > Employee List. Staff are able to inactivate their own account even without proper access rights to PMS Master. The system allows account inactivation using the same URL, bypassing role-based access control.

Step to reproduce
1.Login System as Admin
2.Navigate to > User Management > Role
3.Click on untick MASTER and save
4.Copy or use the direct URL for: Master > PMS Master > STaffMaster.
5.Paste the URL in the browser and access the page directly.
6.Observe that the page is accessible even though the user does not have the required access rights.
7.Attempt to inactivate a staff account from the Employee List.
8.Observe screen > that the system allows the inactivation action without proper authorization.

Expectation:
The system should enforce proper access control. Only authorized users with PMS Master permission should be able to inactivate staff accounts. Users without access rights should be restricted from accessing the page or performing inactivation actions even via direct URL.

Picture 1: Admin login has not granted this staff access to the Master module.

Picture 2: The staff can access the direct URL even though access has not been granted by the Admin. The URL is copying and pasting from the admin access.

Video 1: The

Files

Download all files
clipboard-202606041150-eovse.png (136 KB) clipboard-202606041150-eovse.png Nur'Ain Binti Karim, 04/06/2026 11:50 AM
clipboard-202606041151-8lbju.png (149 KB) clipboard-202606041151-8lbju.png Nur'Ain Binti Karim, 04/06/2026 11:51 AM
Medcare - Google Chrome 2026-06-05 10-09-50.mp4 (18.6 MB) Medcare - Google Chrome 2026-06-05 10-09-50.mp4 Nur'Ain Binti Karim, 05/06/2026 10:32 AM
bandicam 2026-08-24 11-13-46-846.mp4 (2.1 MB) bandicam 2026-08-24 11-13-46-846.mp4 Tejashri Tanaji Jagtap, 24/08/2026 01:46 PM

Related issues 2 (2 open — 0 closed)

Related to HUMS Hospital - Feature #93822: HUMS Security FATAssignedIlango Chandrasekaran29/05/2026

Actions
Related to HUMS Hospital - Task #93827: Authorization/Verify role-based access controlCodedZaldy Conrad Tungcap29/05/2026

Actions
Actions
Copy link
 #2

Updated by Daniyal Ansari 5 months ago

  • Assignee changed from Daniyal Ansari to Kunal Yelne
Actions
Copy link
 #3

Updated by Kierthini Nethi 4 months ago

Actions
Copy link
 #4

Updated by Kierthini Nethi 4 months ago

  • Related to Task #93827: Authorization/Verify role-based access control added
Actions
Copy link
 #5

Updated by Kierthini Nethi 4 months ago

  • Tracker changed from Bug to Gaps
  • Severity deleted (Critical)
  • Bug/Defect On deleted (QA)
  • Function HUMS added
Actions
Copy link
 #6

Updated by Kierthini Nethi 4 months ago

  • Category set to MedCare
Actions
Copy link
 #7

Updated by Daniyal Ansari 4 months ago

  • Dev Due date set to 05/08/2026
Actions
Copy link
 #8

Updated by Daniyal Ansari 3 months ago

  • Dev Due date changed from 05/08/2026 to 12/08/2026
  • Release date to QA set to 13/08/2026
Actions
Copy link
 #9

Updated by Kunal Yelne 3 months ago

Backend changes done

postman request POST 'https://mykarecloud360-dev.hatiintl.com.my/identity-service/user/logout-user/50114' \
--header 'accept: application/json, text/plain, */*' \
--header 'accept-language: en-US,en;q=0.9' \
--header 'authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ5U3ZTUXMzT2N2eENJNWx0bFJ4dHM4R18wT2VsdEh3MDF6bFAwc2lmMXY0In0.eyJleHAiOjE3ODcwNTY0NTQsImlhdCI6MTc4Njk3MDA1NCwianRpIjoiOTA0OWVkN2MtNzc0My00ZjczLWFlNDctZjkxZDk3NmUzZmI0IiwiaXNzIjoiaHR0cDovL2tleWNsb2FrOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjlmY2QwMTM1LWM2MTgtNDc0Ni1hODQzLWE1Zjk0MzU0YTkwYiIsInR5cCI6IkJlYXJlciIsImF6cCI6ImhhdGktYXBwIiwic2Vzc2lvbl9zdGF0ZSI6ImVjM2VlZGU3LWVkN2QtNDllYi05YTc0LTQwZTg1MDRjZDViMiIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZGVmYXVsdC1yb2xlcy1tYXN0ZXIiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJwcm9maWxlIGVtYWlsIiwic2lkIjoiZWMzZWVkZTctZWQ3ZC00OWViLTlhNzQtNDBlODUwNGNkNWIyIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsIm5hbWUiOiJNYWhlc2ggQnViYW5lIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibWFoZXNoIGJ1YmFuZSIsImdpdmVuX25hbWUiOiJNYWhlc2giLCJmYW1pbHlfbmFtZSI6IkJ1YmFuZSIsImVtYWlsIjoicXVlZGRhZGRldW1tYXF1YS03MzgyQHlvcG1haWwuY29tIn0.J31-MO27F191yW7mBV0KPCcjl8of-N1a0QsOsGS17QDHkRhypCL9PU8XLnc7MEnp5LheCwyi8LQmJUNozgEeGB1uKjHKwBcYvFGRcnybDkFHXmYHEyoT3GJMu9rBJhlpW3ypeYbIcMog375JgIRfYSr8FAVw2ZKmg01BuxBQUdGOL6wA9i92tHmgXIsko7LEHtMmbvDvBmx8vWMm3CjWIpfKli0MiO_aZFhUegPzKKVeq6m4M7JCogD98JUeR5gEWwfV3LFsxOKUmyO_j_9ca-KFjzVTvonHbXXup9SWy5lCIFDP3vjqJwYDit2unxj6ARA_5n2iEWJXRatGZH4SIA' \
--header 'content-type: application/json' \
--header 'isrestrictedaccess: false' \
--header 'isresultrestristedaccess: false' \
--header 'origin: https://mykarecloud360-dev.hatiintl.com.my' \
--header 'priority: u=1, i' \
--header 'referer: https://mykarecloud360-dev.hatiintl.com.my/usermanagement/' \
--header 'responsetype: json' \
--header 'sec-ch-ua: "Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"' \
--header 'sec-ch-ua-mobile: ?0' \
--header 'sec-ch-ua-platform: "Windows"' \
--header 'sec-fetch-dest: empty' \
--header 'sec-fetch-mode: cors' \
--header 'sec-fetch-site: same-origin' \
--header 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36' \
--header 'x-activeshiftid: open' \
--header 'x-api-version: 1' \
--header 'x-countercode: Cash3' \
--header 'x-counterid: 4' \
--header 'x-countername: e' \
--header 'x-employeeid: 50515' \
--header 'x-language: EN' \
--header 'x-machine-ip: ' \
--header 'x-orgcode: HATI' \
--header 'x-orgid: 1' \
--header 'x-shiftid: 0' \
--header 'x-unitcode: HISCKL' \
--header 'x-unitid: 1' \
--header 'x-unitprefix: 1' \
--header 'x-userid: 50122' \
--header 'x-username: Mahesh Bubane' \
--header 'Cookie: isClinical=true'

Actions
Copy link
 #10

Updated by Kunal Yelne 3 months ago

  • Assignee changed from Kunal Yelne to Tejashri Tanaji Jagtap
Actions
Copy link
 #11

Updated by Kunal Yelne 3 months ago

Updated Api

curl --location 'https://mykarecloud360-dev.hatiintl.com.my/identity-service/user/logout-user' \
--header 'accept: application/json, text/plain, */*' \
--header 'accept-language: en-US,en;q=0.9' \
--header 'authorization: Bearer {{supabase_service_role_api_key_14a8}}eyJleHAiOjE3ODcwNTY0NTQsImlhdCI6MTc4Njk3MDA1NCwianRpIjoiOTA0OWVkN2MtNzc0My00ZjczLWFlNDctZjkxZDk3NmUzZmI0IiwiaXNzIjoiaHR0cDovL2tleWNsb2FrOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjlmY2QwMTM1LWM2MTgtNDc0Ni1hODQzLWE1Zjk0MzU0YTkwYiIsInR5cCI6IkJlYXJlciIsImF6cCI6ImhhdGktYXBwIiwic2Vzc2lvbl9zdGF0ZSI6ImVjM2VlZGU3LWVkN2QtNDllYi05YTc0LTQwZTg1MDRjZDViMiIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZGVmYXVsdC1yb2xlcy1tYXN0ZXIiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJwcm9maWxlIGVtYWlsIiwic2lkIjoiZWMzZWVkZTctZWQ3ZC00OWViLTlhNzQtNDBlODUwNGNkNWIyIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsIm5hbWUiOiJNYWhlc2ggQnViYW5lIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibWFoZXNoIGJ1YmFuZSIsImdpdmVuX25hbWUiOiJNYWhlc2giLCJmYW1pbHlfbmFtZSI6IkJ1YmFuZSIsImVtYWlsIjoicXVlZGRhZGRldW1tYXF1YS03MzgyQHlvcG1haWwuY29tIn0.J31-MO27F191yW7mBV0KPCcjl8of-N1a0QsOsGS17QDHkRhypCL9PU8XLnc7MEnp5LheCwyi8LQmJUNozgEeGB1uKjHKwBcYvFGRcnybDkFHXmYHEyoT3GJMu9rBJhlpW3ypeYbIcMog375JgIRfYSr8FAVw2ZKmg01BuxBQUdGOL6wA9i92tHmgXIsko7LEHtMmbvDvBmx8vWMm3CjWIpfKli0MiO_aZFhUegPzKKVeq6m4M7JCogD98JUeR5gEWwfV3LFsxOKUmyO_j_9ca-KFjzVTvonHbXXup9SWy5lCIFDP3vjqJwYDit2unxj6ARA_5n2iEWJXRatGZH4SIA' \
--header 'content-type: application/json' \
--header 'isrestrictedaccess: false' \
--header 'isresultrestristedaccess: false' \
--header 'origin: https://mykarecloud360-dev.hatiintl.com.my' \
--header 'priority: u=1, i' \
--header 'referer: https://mykarecloud360-dev.hatiintl.com.my/usermanagement/' \
--header 'responsetype: json' \
--header 'sec-ch-ua: "Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"' \
--header 'sec-ch-ua-mobile: ?0' \
--header 'sec-ch-ua-platform: "Windows"' \
--header 'sec-fetch-dest: empty' \
--header 'sec-fetch-mode: cors' \
--header 'sec-fetch-site: same-origin' \
--header 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36' \
--header 'x-activeshiftid: open' \
--header 'x-api-version: 1' \
--header 'x-countercode: Cash3' \
--header 'x-counterid: 4' \
--header 'x-countername: e' \
--header 'x-employeeid: 50515' \
--header 'x-language: EN' \
--header 'x-machine-ip;' \
--header 'x-orgcode: HATI' \
--header 'x-orgid: 1' \
--header 'x-shiftid: 0' \
--header 'x-unitcode: HISCKL' \
--header 'x-unitid: 1' \
--header 'x-unitprefix: 1' \
--header 'x-userid: 50122' \
--header 'x-username: Mahesh Bubane' \
--header 'Cookie: isClinical=true' \
--data '[
50059,
8603,
11206,
50060,
50078,
50110,
27077,
50063,
17374,
17374,
34131,
35494,
39224,
17420,
17420,
50002,
50006,
50073,
50012,
17383,
17383,
50013,
50015,
50045,
50114,
50124,
50125,
50153,
50156
]'

Actions
Copy link
 #12

Updated by Tejashri Tanaji Jagtap 3 months ago

  • Status changed from New to Assigned
Actions
Copy link
 #13

Updated by Tejashri Tanaji Jagtap 3 months ago

Actions
Copy link
 #14

Updated by Shweta Sandip Waghmare 2 months ago

  • Status changed from Coded to QA
Actions
Copy link
 #15

Updated by Shweta Sandip Waghmare 2 months ago

  • Assignee changed from Tejashri Tanaji Jagtap to Mangesh Pangrekar
Actions
Copy link

Also available in: Atom PDF