Insufficient authorization checks on certain HR workflow endpoints allow authenticated users to access records they are not permitted to view. Any logged-in user, including those assigned only the Employee role, can read candidate record details and employee email addresses, as well as trigger emails to be sent to employees.