Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Admin can remove another admin from the organization

Aperta
  • Qualcosa non va?
#6,314 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
authorization

Direzione di ricerca

The report says the membership API edit queryset permits active organization admins to manage memberships and the delete safeguard only protects the last active admin; it names no files or tests. Start by tracing the membership API's edit queryset and deletion safeguard, then check existing permission tests. Done means an organization admin cannot remove another admin, while a web admin can revoke admin membership.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Target branch: unstable

Observed behavior

An organization admin can remove another admin from the organization. This action should be restricted because it changes the user's organization membership and strips administrative access.

Errors and logs

No application error is expected when removing an admin membership. The organization membership DELETE endpoint returns HTTP 204 when the removal succeeds. The backend allows active organization admins to delete memberships, and its safeguard only rejects deletion when the target is the organization's last active admin (HTTP 400). It does not block deletion based on the target's admin role when another active admin remains.

Expected behavior

An admin should not be able to remove another admin from the organization. Only a web admin should be allowed to revoke organization membership for admins.

User-facing consequences

This allows unauthorized removal of administrative access, which can destabilize the organization, reduce administrative coverage, and create a situation where a user is unexpectedly removed from the organization without proper control.

Steps to reproduce

  1. Sign in as an organization admin.
  2. Navigate to the organization SHARING tab.
  3. Find another user whose role is Admin.
  4. Choose the option to remove the user from the organization.
  5. Observe that the request succeeds with HTTP 204 and the target admin's membership is deleted, as long as another active admin remains. If the target is the last active admin, the request is rejected.

Context

The membership API's edit queryset allows active organization admins to manage memberships, including memberships whose target role is Admin. The delete safeguard only preserves at least one active admin; it does not prohibit one admin from removing another. This report reflects the current backend behavior rather than a client-side error.

AI usage

The bugs were gathered by a human and later turned into issue descriptions with the help of an AI assistant. The assistant was used to draft the wording and structure of the report, and the final text was reviewed and adjusted for accuracy based on the supplied bug summary.

Lingua principale
Python
Stelle
192
Fork
310
Merge medio
2g 10h
PR unite (30g)
66

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di learningequality/studio

Tutte le issue di learningequality/studio

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.