A PIN is not a record
Any office account on our system could set any staff member’s till PIN, at any venue. A PIN is not information about somebody — it is how they sign in at a counter. Setting theirs hands over their till.
Most of what a back office holds is information about people. A phone number, a start date, a holiday balance. Getting the permissions wrong on those is a disclosure: somebody sees something they should not.
A till PIN is not that. A PIN is not a fact about a person, it is the person — the six digits are the whole of how they identify themselves at a counter. So setting somebody else’s is not a disclosure at all. The new number is chosen by whoever set it, which means they can then walk up to that counter and be that person.
What we found
The route that sets a PIN handled one case carefully and the other not at all. Somebody signed in at a till with six digits is pinned to their own record and cannot ask about anybody else — that part was right. An office session took the staff id straight from the request, looked the person up, and wrote the new PIN. Nothing checked which venue that person worked at.
Every role but the till could reach it. So a vendor with one kitchen could have set the PIN of anybody at any other kitchen by guessing a small whole number.
The fix broke the feature, and the test caught it
Worth saying because it is the ordinary way this goes wrong. The first version of the fix applied the venue check to everybody. But a staff session — somebody signed in with a PIN — holds no venue grants at all, so the check answered “no venues” for them and every member of staff setting their own PIN was refused.
A fix that refuses everybody passes every test written about the attack. The only thing that catches it is a test asserting the ordinary case still works, which is why we write those first and why they are worth the extra ten minutes.
If you run a venue
The question to ask your system is not “who can see the staff list”. It is who can change how somebody signs in — PINs, passwords, card fobs, whatever your counter uses. Those should be held to the standard of authentication, not the standard of a staff record, and they should be scoped to the venue that person actually works at.
On our live system nine people have staff records across five venues, five of them with a PIN set, and five of the six office accounts are scoped to a single venue. So both sides of this were real. Nothing says it was ever used, and nothing would have recorded it if it had been — which is part of why it was worth fixing rather than watching.