Currently any user account having access BIPDataModelDeveloper role is providing the ability to see any sensitive information in the Oracle fusion irrespective of data restrictions placed in the front end through role assignments.
User while creating a data model can see any HCM data like (Payroll details, DOB, SSN, etc.) as well as financial data like (Invoice number, payment details etc.)
This should be restricted in such a way that ONLY HCM user can see HR data and only Financial/Supplier user should see FSCM data. Otherwise this is a huge data breach issue of serious concern as it will lead to leakage of PII Data of all the users in the Oracle Instance.
SUGGESTED SOLUTION:
While creating a Data Model and when we choose "SQL Query" for obtaining data they will ask us the option to choose between the below (Navigation --> reports and analytics --> Create --> Data Model --> SQL Query --> Data Source):
- AudioViewDB
- Demo
- Oracle BI EE
- ApplicationDB_FSCM
- ApplicationDB_HCM
- ApplicationDB_CRM
This data source needed to be restricted, Segregate these Data source using separate privileges.
