Gaps #93910
Updated by Nur'Ain Binti Karim 5 months ago
*Issues Description:* Master > PMS Master > Employee List. Staff are able to inactivate their own account even without proper access rights to PMS Master. The system allows account inactivation using the same URL, bypassing role-based access control. *Step to reproduce* 1.Login System as Admin 2.Navigate to > User Management > Role 3.Click on untick MASTER and save 4.Copy or use the direct URL for: Master > PMS Master > STaffMaster. 5.Paste the URL in the browser and access the page directly. 6.Observe that the page is accessible even though the user does not have the required access rights. 7.Attempt to inactivate a staff account from the Employee List. 8.Observe screen > that the system allows the inactivation action without proper authorization. *Expectation:* The system should enforce proper access control. Only authorized users with PMS Master permission should be able to inactivate staff accounts. Users without access rights should be restricted from accessing the page or performing inactivation actions even via direct URL. Picture 1: Admin login has not granted this staff access to the Master module. !clipboard-202606041151-8lbju.png! Picture 2: The staff can access the direct URL even though access has not been granted by the Admin. The URL is copying and pasting from the admin access. !clipboard-202606041150-eovse.png! Video 1: The