Hi everyone, I found a permissions gap in Aspire today that I think every admin should check for.
A user with Branch Admin access can create new contacts and change the user roles of existing contacts, even if their own role does not have the Manage User Roles permission.
A bad actor with Branch Admin access could:
- Create a new employee contact and user
- Assign that user any existing role that does have Manage User Roles
- Log in as that user and escalate the role to System Admin, payroll access, or anything else
The fix: Review every role at Branch Admin level or below and make sure Manage User Roles is unchecked on all of them. If a lower-level role needs that permission for a legitimate reason, that’s the role to lock down first.
This is especially important if you have to give a Sr. estimator Branch Admin access for item catalog management, or template management.
