Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Admin can remove another admin from the organization

Abierto
  • ¿Algo no está bien?
#6,314 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
authorization

Línea de trabajo

The report says the membership API edit queryset permits active organization admins to manage memberships and the delete safeguard only protects the last active admin; it names no files or tests. Start by tracing the membership API's edit queryset and deletion safeguard, then check existing permission tests. Done means an organization admin cannot remove another admin, while a web admin can revoke admin membership.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Target branch: unstable

Observed behavior

An organization admin can remove another admin from the organization. This action should be restricted because it changes the user's organization membership and strips administrative access.

Errors and logs

No application error is expected when removing an admin membership. The organization membership DELETE endpoint returns HTTP 204 when the removal succeeds. The backend allows active organization admins to delete memberships, and its safeguard only rejects deletion when the target is the organization's last active admin (HTTP 400). It does not block deletion based on the target's admin role when another active admin remains.

Expected behavior

An admin should not be able to remove another admin from the organization. Only a web admin should be allowed to revoke organization membership for admins.

User-facing consequences

This allows unauthorized removal of administrative access, which can destabilize the organization, reduce administrative coverage, and create a situation where a user is unexpectedly removed from the organization without proper control.

Steps to reproduce

  1. Sign in as an organization admin.
  2. Navigate to the organization SHARING tab.
  3. Find another user whose role is Admin.
  4. Choose the option to remove the user from the organization.
  5. Observe that the request succeeds with HTTP 204 and the target admin's membership is deleted, as long as another active admin remains. If the target is the last active admin, the request is rejected.

Context

The membership API's edit queryset allows active organization admins to manage memberships, including memberships whose target role is Admin. The delete safeguard only preserves at least one active admin; it does not prohibit one admin from removing another. This report reflects the current backend behavior rather than a client-side error.

AI usage

The bugs were gathered by a human and later turned into issue descriptions with the help of an AI assistant. The assistant was used to draft the wording and structure of the report, and the final text was reviewed and adjusted for accuracy based on the supplied bug summary.

Lenguaje dominante
Python
Estrellas
192
Forks
310
Merge medio
2 d 17 h
PR fusionados (30 d)
69

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de learningequality/studio

Todos los issues de learningequality/studio

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.