Requested participants added automatically by people who are not a participant

[Kevin van Schijndel]

Hi all,

We have noticed a case in which someone with no relation to a ticket (neither as a reporter, nor as a requested participant) can add other people to the ticket as a requested participant.

When a reporter or requested participant in a ticket sends an e-mail to a ticket with someone in CC, that person gets added to the ticket as a requested participant. That is the desired workflow. Since someone with a relation to the ticket is adding the person in CC, we would like the person in CC to also receive our updates from the ticket.

But now we noticed that someone who is not a reporter or requested participant in a ticket, is also able to add someone to the ticket. If someone without any relation to the ticket sends an e-mail to the ticket, we get a notification that the person sending the e-mail has no access to the ticket. The person is not automatically added tot the ticket. We then are able to chose whether we would like to add that person as a requested participant. This is the desired workflow, as we would not like people to be able to add their selves to a ticket they have to relation to, without any permission.

However, if the person in the situation described above sends an e-mail to the ticket with someone in CC, that person gets automatically added as a requested participant. That means someone without any relation to a ticket can add other people to that ticket. Even though they don't have any relation to the ticket as well.

Does anyone have any idea how to prevent people who are not connected to a ticket from adding people to that ticket? But meanwhile still have people who are connected to a ticket add people to the ticket as they wish?