Unauthorized Task Dependency Deletion in Modern UX

Products

• Clarity PPM SaaS
• Clarity PPM On Premise

Issue/Introduction

User with "Project - Edit Assigned Tasks" right is able to delete dependencies in the Modern UX Timeline for tasks to which they are not assigned. While the system correctly blocks these users from creating dependencies, it fails to enforce the same authorization restrictions during deletion.

Steps to Reproduce

1. Project Setup: Create a project containing three tasks: T1, T2, and T3.
2. Dependency Setup: Establish a dependency link between T2 and T3.
3. User Configuration: Create/Identify User ABC and grant only the following permissions:
   • Project - Edit Assigned Tasks - All
   • Project - View Tasks - All
   • Project Management - Tiles Navigate
   • Project Management - Navigate
4. Staffing: Add User ABC to the project staff but assign them only to T1.
5. Execution: Log in as User ABC, navigate to the Project Timeline, and attempt to delete the dependency between T2 and T3.

Expected Behavior

The deletion attempt should be denied. Since User ABC is not assigned to T2 or T3, they should receive an authorization error consistent with the error triggered when attempting to create a new dependency.

Actual Behavior

The dependency is successfully deleted. The system fails to validate that the user lacks assignment-based edit rights for the affected tasks, allowing unauthorized modification of the project schedule.

Environment

Clarity 16.4.1

Cause

DE185703

Resolution

DE185703, in review by engineering.