Sharing Secrets with Groups that i am not member of?

Community Feedback
1

Good day everyone,
I am using Passbolt-CE for sharing PW with my family and friends.

I’ve been sharing PWs with other users frequently and the Folder sharing with Teams/Groups is very convenient to automatically sharing secrets with a group of people.

But i am not sure if it is a feature or a bug if a standard User (no-admin) can share Secrets
with a Team that he/she is not part of? I tried to check if it is caused by a setting with the RBAC, but I could not find a way to switch that behavior off.
On our server we have multiple groups that sound very similar, so I accidentally shared the PW with the wrong group and only found out as my friend could not find the PW shared with him…

It is maybe not a big deal as you can anytime check the to whom you have shared a PW with at “Shared with”, but maybe that could somehow be prevented in the future.
What do you think about that issue / features and how can i switch that off ?
Thx, best regards!

3

Hi @Deliciousbob

this https://community.passbolt.com/t/new-release-5-15-0-who-is-he-browser-extension-api/14707#p-33927-clearer-permission-confirmation-changes-2 should help slightly. Although it would be hard to completely avoid mistakes related to similar group names.

For now this is kind of a design pattern (not a bug) where you can see and attach a passwords to groups you are not part of. I can imagine that’s a common strategy on some organisations to share something like WiFi password designed to particular group of people by the IT guys, or to a development tool where that IT admin is only and admin, not a member. You can change that as an Admin in the RBAC settings.