Flagsmith/flagsmith

Regular users are able to create invites with ADMIN role

Closed this issue · 1 comments

matthewelwell commented

To reproduce:

  1. As a regular user in a paid organisation, use an API client to send a POST request to /api/v1/organisations/:id/invite/ with the role of "ADMIN"`.

Expected behaviour:

The user receives a 403

Actual behaviour:

The invite is created

matthewelwell commented

Resolved in #4653