Unable to unlink related tickets without DELETE permission on ticket (GLPI 11.0.7)

[marceloprado93]

Code of Conduct

• I agree to follow this project's Code of Conduct

Disable plugins

• I reproduce the issue with all plugins disabled

Is there an existing issue for this?

• I have searched the existing issues

Version

11.0.7

Bug description

Users are able to link tickets together, but they cannot unlink them unless the "Delete" permission is granted on Tickets.

The problem is that granting the "Delete" permission also allows users to permanently delete tickets, which is a much broader permission than simply removing a relationship between tickets.

Expected behavior

A user with access to both tickets and permission to update tickets should be able to remove the relationship between linked tickets without requiring the "Delete" permission.

Current behavior

When the "Delete" permission is removed from the profile:

The "Unlink" action disappears from linked tickets.
Users can no longer remove ticket relationships.

When the "Delete" permission is granted:

The "Unlink" action becomes available.
Users are also able to delete tickets.

Relevant log output

Page URL

No response

Steps To reproduce

1. Create two tickets.
2. Link the tickets together.
3. Use a profile with Read and Update permissions on tickets.
4. Remove the Delete permission from the profile.
5. Open one of the linked tickets.
6. Observe that the Unlink action is not available.
7. Grant the Delete permission.
8. Observe that the Unlink action becomes available.

Your GLPI setup information

No response

Anything else?

[marceloprado93]

Expected result

The ability to unlink tickets should be independent from the ability to delete tickets.

Additional information

The user has access to both tickets and was the user who created the relationship between them.

This creates a permission escalation problem: to allow users to only remove a relationship between tickets, administrators must also grant permission to delete the ticket itself.