Guests can assign tasks to any member of the Organization they're guest of

Hello,

we’ve found a problem with the rights of assignees:

Team A has only three invited users:

  1. info@ourdomain…

  2. ben@ourdomain…

  3. john.doe@customer…

Team B has only two invited users:

  1. info@ourdomain

  2. carla.smith@company…

The problem lies in Team B if user Carla wants to assign a task.

Carla is able to assign the task to user (ben@ourdomain… from Team A even though this users has no invitation and is not a member of Team B!

Hi @magnolia4 and thanks for reaching out!

This is not a bug, but an expect behaviour; Guests can assign a task to any Member of the Org; that explains why Carla can assign a task to Ben.

However, note that two Guests can only see each other if they belong at least to one team in common!

To learn more about Guest permissions, i would highly recommend you to check out this article from our guide: https://asana.com/guide/help/organizations/guests

And of course, if you have any questions, please let me know; I’ll be more than happy to assist you further :slight_smile:

1 Like

Hi Marie,

thank u for your answer!

What means “Member of the Org”?
Is Ben a member of the Org because he has the same mail-domain?

By the way: Ben is not member of the Org. He is also a guest and got a invitation for the team.

No worries, you’re very welcome!

Org Members are users sharing your Organisation domain; Guests are members using a different email than yours! You can learn more about this in this other article: https://asana.com/guide/help/faq/common-questions#gl-guests

If Ben and Carla are both Guests, they should not be able to see each other unless they belong at least to one team in common!

Ok, I see ;-=

However, it’s a bug because Ben can’t access to the task and info@domain can’t also access because it can’t see the task in the project.

Please check this constellation in an asana acount - you will see there is a problem :wink:

Hi @magnolia4,

Unfortunately, I can’t access your account via the Forum and in order to investigate this issue further, I would need access to several private information that can’t be shared publicly in the Forum. So if you’d like us to investigate the issue further, I would encourage you to reach out directly to our support team who will be able to take a closer look into this for you.

Feel free to reference the URL of this thread to save yourself from re-explaining everything :slight_smile:

Well, this is not a personal/ account bug!

Why do not you just test this with a trial account?

@magnolia4, I just did with my test account and wasn’t able to reproduce. I also liaised with our support team and we haven’t received any similar reports in the last few days, this leads me to think there must be something triggering this in your account; and like I said in my previous message I can’t access it via the Forum. our support team will be in much better position to help you here.

Apologies for not being able to help you further via the Forum with this specific issue. If there is anything else I can help you with, please let me know!