cve-dashboard/docs/kb-user-management-guide.md

User Management & Roles Guide

Overview

The STEAM Security Dashboard uses role-based access control with four user groups. Only administrators can manage users. All user operations are logged in the audit trail.

User Groups

Group	Access Level	Description
Admin	Full access	All operations including user management, delete, audit log
Standard_User	Operational access	Create, edit, limited delete (own resources only), exports
Leadership	Read-only + exports	View all data, download CSV/XLSX exports
Read_Only	View only	Read-only access to all pages, no modifications

Permission Matrix

Action	Admin	Standard_User	Leadership	Read_Only
View findings/CVEs	Yes	Yes	Yes	Yes
Sync Ivanti data	Yes	Yes	No	No
Edit hostname/DNS overrides	Yes	Yes	No	No
Edit notes	Yes	Yes	No	No
Add to queue	Yes	Yes	No	No
Create FP workflows	Yes	Yes	No	No
Edit FP submissions	Yes	Yes	No	No
Upload compliance reports	Yes	Yes	No	No
Add CVEs	Yes	Yes	No	No
Upload documents	Yes	Yes	No	No
Export CSV/XLSX	Yes	Yes	Yes	No
Delete CVEs/documents	Yes	Own only	No	No
Manage users	Yes	No	No	No
View audit log	Yes	No	No	No

Managing Users (Admin Only)

Accessing User Management

1. Click the user icon in the top navigation bar
2. Select "User Management" from the menu
3. The user list shows all accounts with their group, status, and last login

Creating a New User

1. Click "Add User"
2. Fill in the required fields:
   • Username — must be unique
   • Email — user's email address
   • Password — initial password (user should change on first login)
   • Group — select from Admin, Standard_User, Leadership, or Read_Only
3. Click Save

New users default to Read_Only if no group is specified.

Editing a User

1. Click the edit icon on the user row
2. Modify username, email, or group
3. Optionally set a new password (leave blank to keep current)
4. Click Save

Changing User Groups

When changing a user's group, a confirmation dialog appears. Extra warnings are shown when:

• Removing Admin privileges from a user
• Upgrading a user to Admin

Group changes are logged separately in the audit trail with the previous and new group recorded.

Deactivating Users

Users can be deactivated rather than deleted. Deactivated users cannot log in but their data and audit history are preserved.

Authentication

• Sessions use httpOnly cookies with 24-hour expiry
• Passwords are hashed with bcryptjs
• All API endpoints (except login) require a valid session
• Failed login attempts are not rate-limited at the application level

Audit Log

The audit log records all significant actions in the dashboard. Only admins can view it.

What's Logged

• User creation, updates, group changes, deletion
• CVE creation, updates, deletion
• Document uploads and deletions
• Ivanti sync operations
• FP workflow submissions and edits
• Queue operations
• Compliance uploads
• Login/logout events

Audit Entry Fields

Each entry includes:

• Timestamp
• User who performed the action
• Action type (e.g., user_create, ivanti_fp_workflow_created)
• Entity type and ID
• Details (JSON with specifics of what changed)
• IP address

Default Admin Account

On first setup (node setup.js), a default admin account is created:

• Username: admin
• Password: set during setup
• Group: Admin

Change the default password immediately after first login.