Adult permissions requirements allow PII leak

Some Scouts are too young to have their own Scoutbook accounts, so their parents must send messages on their behalf.

However, while youth accounts can send messages to anyone in the troop, adult accounts must have “View Profile” rights to other child accounts in Connection Manager in order to send messages. This does not allow them to actually see any details (address, DOB, etc.) for the individual Scout by clicking the name on the roster. However, if the parent clicks the Settings gear in the top right corner, they can select “Show DOB” and it will be added to the roster for all Scouts with “View Profile” privileges, thus leaking the PII that is DOB.

I can readily replicate the screens and settings in question. We need the ability for parents to be able to send messages within the patrol (and perhaps Troop – e.g. popcorn chairs) without seeing any profile information.

Eric,

We have duplicated the issue and passed it on to the developers to fix. We have requested DOB and age be hidden in the roster if DOB is selected and the user does not have an Edit Profile or Full Control connection.

Thank you.
As the “View profile” doesn’t actually show any profile information – revealing just the Scout’s last name, parents, and merit badge count over the other (non-privileged) roster information – should it be renamed to a more appropriate description?

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.