The Program Administrator is aware of an issue affecting 61 Approved Vendors (AVs), in which the use of identical Disclosure Form file names made an incorrect project Disclosure Form accessible to credentialed Program portal users (Approved Vendors or Designees) by downloading an executed Disclosure Form from an unrelated record. Specifically, if two different users utilized the same file name for their Disclosure Forms, one user may have been able to access the other user’s Disclosure Form of the same name.
The Program Administrator determined that 61 AVs had uploaded Disclosure Forms with identical file names, but only 32 of those AVs had Disclosure Forms that share a file name with another Approved Vendor or Designee, thus reducing the number of Disclosure Forms that were impacted by this issue.
The file naming issue ultimately impacted 5,342 Disclosure Forms, but only 135 Disclosure Forms with potential visibility to an incorrect Approved Vendor or Designee. No Disclosure Form data has been lost or overwritten as a result of this issue. Currently, no action is needed by Approved Vendors or Designees.
The Program Administrator will reach out to those Approved Vendors impacted by this file naming issue.
The Program Administrator has developed a solution designed to ensure that moving forward, each uploaded Disclosure Form receives a unique name regardless of how the stakeholder named the file. The Program Administrator will implement a solution during the planned system maintenance period on Thursday, June 19, 2025 beginning at 8:00 p.m. CPT. During this time, the Program portal will be unavailable.
The Program Administrator apologizes for the inconvenience to users and thanks all Program participants for their patience as this issue is remedied.
Should you have any questions, please contact the Program Administrator at [email protected].