Consolidate Line Items Permission Issues, Records That the User Does Not Have Permission To View Are Available For Selection (Doc ID 2403259.1)

Last updated on OCTOBER 04, 2024

Applies to:

Symptoms

ACTUAL BEHAVIOR
---------------
Through the option - Consolidation Line Items, user are able to View unauthorized information.

EXPECTED BEHAVIOR
-----------------------
User can only see authorized information.

STEPS
-----------------------
The issue can be reproduced at will with the following steps:

1) Sign in with Company Workspace administration access

1. Open Company Workspace
2. Locate User Administration
3. Locate User - user1
4. Verified user1 only have permission to 1 shell - shell1
5. Open shell - shell1
6. Locate node - Business Process Name
7. Noticed there is only 1 record

2) Sign in as user1

1. Open shell - shell1
2. Locate node - Business Process Name
3. Create a new Business Process record
4. For section - Summary Items, click on button - Copy then select Consolidate Line Items
5. Noticed lots of records are listed, which the user does not have permission to View

BUSINESS IMPACT
-----------------------
The issue has the following business impact:
Due to this issue, users can see information that they have no access to.

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.