Infos:
- Used Zammad version: 6.5.2-1767354399.5ee205d5.noble
- Used Zammad installation type: package
-
- Server 1 (APP): Zammad application
- Server 2 (DB): PostgreSQL (dedicated)
- Server 3 (ES): Elasticsearch (dedicated)
- Operating system: Ubuntu 24.04.3 LTS all 3 servers
- Browser + version: Brave 1.85.120
Expected behavior:
- When using role templates with read / create / change permissions limited per group, users should not be able to see tickets from groups they do not have access to.
- Tickets that are not visible in Overviews (because the user has no group permission) should also not be visible via Search.
- Search results should fully respect group-based access restrictions, identical to Overviews.
Actual behavior:
- Tickets from groups where the user does not have access to any Overview are correctly not visible in Overviews.
- However, the same tickets are still visible via the global Search, even though the user has no permission to access that group.
- This allows users to discover and open tickets that should be completely hidden from them.
- User from another group has to have read permission in case some communication is needed from them.
Steps to reproduce the behavior:
- Create a role template with read / create / change permissions limited to specific groups.
- Assign the role to a user.
- Ensure the user has no Overview access to another group.
- Create or use an existing ticket in that restricted group.
- Log in as the user and confirm:
- The ticket is not visible in Overviews.
- The ticket is visible via Search.
- Open the ticket from Search and confirm it is accessible.
Is there a way to achive this? hide ticketis from group 1 in search so that group 2 can’t see them in search results