Multi-User account allows additional privileges when logged in as lower-level user in Empower - WKB11432

SYMPTOMS

• If the user has the ability to log in as multiple user account types (Administrator, Reviewer, Guest) and is the owner of the project then the software allows privileges even when they are not logged in as the user with that privilege.
• It is also observed that if the user were the owner of any of the user groups, they can modify the respective user group even if they are logged in with a lower lever user type.

ENVIRONMENT

• Empower 3 FR2 and above, until Empower 3 SR3
• Multi-User type account
• User is the owner of the project

CAUSE

PCS #55801 has been created.

FIX or WORKAROUND

• Change project owner to system.
• The issue is fixed in the E3SR3 release. Refer release notes.

ADDITIONAL INFORMATION