🧪 Release Summary – Version 1.65.14.1
1.65.14.1 consists of a single security bug fix.
🔐 Hotfix
ELL-2494 Users can see unassigned site maintenance logs .
Issue:
Users could view reports, and maintenance logs for sites, departments, and units outside their assigned scope within their account database. Users were not able to complete tasks for unassigned instruments.
Root cause: Report-related API endpoints enforced only feature-level authorization (permission to access Compliance Reports) and did not consistently enforce object-level authorization (restriction to the user’s assigned sites, departments, and units) before querying the database.
Several endpoints passed site/department/unit filter parameters directly to stored procedures that treat empty filter values as “no filter” and return data across the full customer organization. When filters were blank on initial load, not yet selected, or reduced to an empty list after access validation, the system returned all records instead of no records or only records within the user’s scope.
This was compounded because:
Custom report endpoints (custom_report_instrument_list, custom_report_logs, export flows) lacked the user-scope filtering already used elsewhere in the application.
The shared report data retrieval logic did not apply a post-query access filter.
One partially protected endpoint still allowed an empty scoped department list to reach the database, triggering the same “no filter = all data” behavior.
Contributing factor: A mismatch between application security expectations (empty scope = no access / user’s allowed scope) and database query design (empty scope = unrestricted query).
Corrective action:
Implemented centralized user-scope validation on affected Compliance / Custom Report endpoints to intersect requested filters with the user’s assigned sites, departments, and units, and to return empty results when no authorized scope remains. Added secondary filtering in shared report retrieval logic to ensure results are limited to authorized organizational scope before being returned or exported.
*Release date = the date a version was released into the Production environment. Each Lab Logs environment will display the release date as the date the version was deployed into that environment.