What’s Fixed
Members could previously edit or delete tasks assigned to other team members by
sending a direct API request, bypassing the read-only UI introduced for
attendees. The server now enforces the same ownership rule that CanCanCan
already applies to other resources: a member can only update or delete a task
they own.
What changed
- A member who opens a task assigned to another user sees a read-only view and
cannot save changes or delete the task from the UI. - If a write is attempted through any other path (API client, automation, future
integration), the server returns a 403 and the action is rejected. - Admins and owners are unaffected — they retain full edit and delete access on
all tasks.