Customer of an organization can unlink the organization of requests they not own!

[Marcel_Wirtz]

Hello,

does anyone uses the customer and organization feature in service desk.

We think we found the following bug:

Two users in the same organization, can see the requests the other user created if the requests is shared with the organization, so nothing wrong with that.

But why can the user which does not create the requests REMOVE the organization link of the requests so it is not visible to any other expect of the owner?

I don't think thats right at all. Should not only the owner of the request decide if the request is shared or not?

Kind regards,
Marcel

PS.: I would have create a bug requests for this, but due to support restrictions with the starter edition i am not allowed to.

[Susan Hauth _Jira Queen_ · Accepted solution]

Hi Marcel,

This has been raised JSDSERVER-4721 for Server and JSDCLOUD-4721.  It has been raised as a suggestions but I think it's a bug as well. Please vote and comment on these issues.

If happy with this answer please mark as answered.

Susan

[Marcel_Wirtz]

Ah okay thanks, searched for the problem before but it seems i used the wrong search terms :-)

Kind regards,
Marcel