The web application does not lock or terminate administrator sessions after a suitable period of inactivity. During testing, the application session was allowed to remain inactive for several days and the session was not automatically locked or terminated. Permitting an excessively long inactivity period presents the opportunity for an unattended session to be accessed by an unauthorized person. In the worst case, this could result in access to or modification (including deletion) of inmate survey data, privilege escalation and access to critical application functions.
Note: This does not apply to API tokens, as they automatically expire two hours after creation, unless the user commands earlier expiration.