A change committed through Vikunja's LLM-assisted bot let an inherited admin grant override a lower permission on a child project, so restricted users kept admin access in 2.6.0.

@@ -20,7 +20,6 @@ import ( 	"errors"  	"code.vikunja.io/api/pkg/user"

-	"code.vikunja.io/api/pkg/utils" 	"code.vikunja.io/api/pkg/web"  	"xorm.io/xorm"@@ -165,11 +164,8 @@ func checkReadPermissionsForProjects(s *xorm.Session, a web.Auth, projectIDs []i

 	for _, projectID := range projectIDsWithRow { 		permission := &projectReadPermission{project: projects[projectID]} 		if pp, has := projectPermissions[projectID]; has {-			switch pp.MaxPermission {-			case PermissionRead, PermissionWrite, PermissionAdmin:-				permission.canRead = true-				permission.maxPermission = int(pp.MaxPermission)-			}+			permission.canRead = true+			permission.maxPermission = int(pp) 		} 		permissions[projectID] = permission 	}

@@ -347,90 +343,30 @@ func (p *Project) checkPermission(s *xorm.Session, u *user.User, permissions ...

 	}  	for _, r := range permissions {-		if r == permission.MaxPermission {+		if r == permission { 			return true, nil 		}

 	}  	return false, nil }

 -type projectPermission struct {-	ID            int64 `xorm:"pk autoincr"`-	MaxPermission Permission-}--func checkPermissionsForProjects(s *xorm.Session, u *user.User, projectIDs []int64) (projectPermissionMap map[int64]*projectPermission, err error) {-	projectPermissionMap = make(map[int64]*projectPermission)-+// checkPermissionsForProjects returns the effective permission of the user on each of+// the given projects. Projects the user cannot access are absent from the result.+func checkPermissionsForProjects(s *xorm.Session, u *user.User, projectIDs []int64) (map[int64]Permission, error) {+	permissions := make(map[int64]Permission, len(projectIDs)) 	if len(projectIDs) < 1 {-		return

-	}--	args := []interface{}{-		u.ID,-		u.ID,-		u.ID,-		u.ID,-		u.ID,-		u.ID,-	}--	err = s.SQL(`-WITH RECURSIVE-    project_hierarchy AS (-        -- Base case: Start with the specified projects-        SELECT id,-               parent_project_id,-               0  AS level,-               id AS original_project_id-        FROM projects-        WHERE id IN (`+utils.JoinInt64Slice(projectIDs, ", ")+`)--        UNION ALL--        -- Recursive case: Traverse up the hierarchy-        SELECT p.id,-               p.parent_project_id,-               ph.level + 1,-               ph.original_project_id-        FROM projects p-                 INNER JOIN project_hierarchy ph ON p.id = ph.parent_project_id),--    -- Calculate max team permission for each project/user combination-    max_team_permissions AS (-        SELECT tl.project_id,-               MAX(tl.permission) AS max_team_permission-        FROM team_projects tl-                 INNER JOIN team_members tm ON tm.team_id = tl.team_id AND tm.user_id = ?-        GROUP BY tl.project_id-    ),-

@@ -943,7 +943,7 @@ func addMaxPermissionToProjects(s *xorm.Session, projects []*Project, u *user.Us 	for _, project := range projects { 		permission, has := permissions[project.ID] 		if has {-			project.MaxPermission = Ptr(permission.MaxPermission)+			project.MaxPermission = Ptr(permission) 		} 	} 

@@ -41,10 +41,7 @@ func (pa *projectAccess) permission(projectID int64) (Permission, bool) { 	return p, has } -// Joined against project_ancestors this yields one row per project and granting-// ancestor-or-self, so MAX over a project's rows is the greatest of its own grant and-// everything it inherits: a grant on a descendant can raise an inherited permission,-// never lower it. Binds the user id three times.

+// Binds the user id three times. const projectAccessCTE = ` WITH grants (project_id, permission) AS (     SELECT project_id, MAX(permission)@@ -61,11 +58,19 @@ WITH grants (project_id, permission) AS (     GROUP BY project_id )` +// Inherited admin is sticky (it could unshare the parent anyway); below that the nearest grant wins.

 const projectAccessQuery = projectAccessCTE + `-SELECT pa.project_id AS id, MAX(g.permission) AS permission-FROM grants g-INNER JOIN project_ancestors pa ON pa.ancestor_id = g.project_id-GROUP BY pa.project_id`+SELECT id,+    CASE WHEN MAX(permission) = 2 THEN 2

+         ELSE MAX(CASE WHEN nearest = 1 THEN permission END)

+    END AS permission+FROM (+    SELECT pa.project_id AS id, g.permission,+        ROW_NUMBER() OVER (PARTITION BY pa.project_id ORDER BY pa.depth) AS nearest+    FROM grants g+    INNER JOIN project_ancestors pa ON pa.ancestor_id = g.project_id+) ranked+GROUP BY id` 

 const projectAccessIDsQuery = projectAccessCTE + ` SELECT DISTINCT pa.project_id AS id