# Bug - possible for admin to assign PM to moderator who does not have access to the PM
**URL:** https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571
**Category:** Bug
**Tags:** assign
**Created:** [1 mei 2019 om 13:46 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571 "2019-05-01T13:46:02Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [1 mei 2019 om 13:46 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/1 "2019-05-01T13:46:02Z")
I have noticed what I think is a bug with the [Discourse Assign - #117](https://meta.discourse.org/t/discourse-assign/58044/117) plugin. It is possible for an admin to assign a PM to a moderator who does not have access to the PM. They are notified, but when they click through to see the PM they cannot see it and get an error.
The answer, it seems to me, should be to add the assignee to the message at the same time, or to display an error to the assigner to let them know the assignee is not in the message and cannot be assigned the message.
This obviously does not affect admins who can see all PMs.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [1 mei 2019 om 15:51 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/2 "2019-05-01T15:51:21Z")
I can repro this. An assign notification is generated despite the user not having access to the PM assigned. Same issue occurs in categories with security that mods can’t access.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [1 mei 2019 om 23:34 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/3 "2019-05-01T23:34:34Z")
Oh yeah interesting edge case what can we do here @sam?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2 mei 2019 om 01:29 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/4 "2019-05-02T01:29:10Z")
I think a minimum change here is to pop up an error saying moderator has no access to the PM when the admin / mod tries to assign.
This particular edge case will become much less of an edge case when we unlock “assign” to designated groups that are not mods.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [20 augustus 2019 om 17:20 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/5 "2019-08-20T17:20:03Z")
I just came across this again today - we are finding that I have assigned lots of messages to moderators who do not have access to them and hence have not been following up on them. Whoops.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [21 augustus 2019 om 00:19 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/6 "2019-08-21T00:19:56Z")
LOL can we protect against the above @sam in some simple way?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [21 augustus 2019 om 00:32 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/7 "2019-08-21T00:32:59Z")
> [@sam](#):
>
> This particular edge case will become much less of an edge case when we unlock “assign” to designated groups that are not mods.
This happened now maybe @Roman can follow it up.
---
### Author:  [@Roman](https://meta.discourse.org/u/Roman)
#### Post date: [2 september 2019 om 18:14 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/9 "2019-09-02T18:14:09Z")
I opened a PR to enforce additional rules when trying to assign a topic:
- The user we’re going to assign to must be able to assign.
- The user we’re going to assign must have access to the topic.
Trying to assign to one of these users will raise an error:
I think we should also remove users without access from the assign modal results. To achieve this, I’ll have to extend the core’s user search API a little bit.
Here’s the PR:
[https://github.com/discourse/discourse-assign/pull/46](https://github.com/discourse/discourse-assign/pull/46)
I’ll find someone to review it before merging.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [14 augustus 2020 om 12:03 UTC](https://meta.discourse.org/t/bug-possible-for-admin-to-assign-pm-to-moderator-who-does-not-have-access-to-the-pm/116571/10 "2020-08-14T12:03:04Z")