Release 4.3.3

22.09.2026

All of the issues below require an authenticated session and are fully resolved in this release. Upgrading is recommended for every installation.

Broken Access Control in Legacy View-Tools: An authenticated user could read records outside their permissions. Record access is now enforced through BeanFactory with ACL checks; sensitive fields such as password hashes and tokens are never returned.
User Enumeration in Password-Reset Flow: The Forgot Password flow revealed whether an account existed. All outcomes now return an identical generic response.
SQL Injection in KReports – Pagination Handling: Pagination clauses lacked integer-safe handling. All affected endpoints now go through $db->limitQuery().
SQL Injection in KReports – Condition Builder: Conditions were assembled without quoting user input. All user-supplied values are now quoted before use.
Missing Authorization in the Reminders Module: An authenticated user could modify records belonging to other users. Ownership or ACL write access is now verified before any update.
SQL Injection in Workflow Condition Evaluation: Workflow conditions were evaluated without quoting, allowing users with edit rights to influence generated SQL. All values are now quoted and unknown field names rejected.
Reflected XSS on a Legacy Error Page: Request parameters were echoed into the page without escaping. All output points now use htmlspecialchars with ENT_QUOTES.
Missing Parent-Record ACL on File Upload: A low-privilege user could attach files to records they had no edit rights on. Edit access on the parent record is now enforced before saving.

Sidepanels & Dashboard

Sidepanel on RecordView: New right-hand information panel (MintSidepanel) for Employee and Candidate records, featuring Tenure, Leave, Day Calendar, Recruitment/Candidatures, Kudos, Trainings, and Competencies widgets. When no widgets are configured, the panel hides and the record expands to full width.
Sidepanel Responsive Behaviour: On smaller screens the sidepanel toggle remains available; when expanded it overlays the record view.
Dashlets Close-Confirmation Popup: The close-recording popup in Meetings, Tasks, and Calls dashlets now uses the MintPopup component for visual consistency.

Documents: Missing Data After Save: Saving a new Document in the new view used to persist only the filename. All form data is now saved correctly.
Date-Time Filter: Search by Day: New “on this day” operator matches any time within a selected date (00:00:00-23:59:59), removing the need to specify an hour.
Work Plans: Sorting by Name: Clicking the Name column header now re-orders the grid correctly.
Global Search: Result Links: Left-clicking and middle-clicking search results now open the correct record.
Kudos Panel: HTTP 500 Error: Fixed an EntityCreator error causing the Kudos drawer to fail with a missing association message.

More info about release: https://github.com/minthcm/minthcm/releases/tag/4.3.3