Attendance Only role can view sensitive information. Cannot change this because of Templates

General Discussion
1

I found that users with any of the basic roles one might assign a regular joe employee (even ones that sound like they are super restricted like Attendance Only role) can view all kinds of sensitive dashboard’s especially ALL of the templates. As they are templates, I cannot change the permission on them. I created a test user to confirm this behavior and indeed it is as stated. As the test user I was able to view sales figures, ticket KPI’s, agreement finance data including profitability and more.

I am kind of shocked as to why the Attendance Only role is being added to finance dashboard TEMPLATES that then cannot be modified/changed. I also found that dashboards created for us by Pro Services had added this and other roles to them without discussion or approval, meaning right out of the box all new custom stuff is accessible by all employees. None of this was covered during onboarding and I only figured this out by one of my staff telling me they could see stuff that they probably shouldn’t see.

This appears to be a serious security issue. Not sure if this is the same for everyone else, but you might want to check yours and raise a flag.

2

I found this is even more concerning in the HR arena. If you use the attendance module, every employee can view every other employee’s schedule, hours worked, overtime, etc. They can ALSO view all PTO requests for ALL employees - including the “reason” field which would likely contain sensitive HR like medical issues or other personal information. They can even export all this data as PDF or CSV.

A concern is that I suspect most other MSPB partners are not aware of this, hence me writing these posts. This raises some serious security concerns considering the kind and volume of our company data that sync’s down to MSPB.