Hi everyone,
I’ve encountered a potential permission issue in a fresh installation of Odoo 17 (Community Edition). I created a demo user and assigned them only the Inventory > User access level (not Administrator). However, when logged in as this user, they are still able to:
- View and edit Operation Types (e.g., Receipts, Internal Transfers, etc.)
- Access stock.picking.type records as a manager (Inventory / Administrator level)
From what I understand, modifying Operation Types should only be possible for users with Inventory > Administrator rights.
I’ve double-checked that the user is not in the Administrator group or granted any extra permissions beyond Inventory > User.
Has anyone else run into this issue? In picture you can see demo user with Inventory->User permission, but he still hets Inventory->Administrator event tho he is not it that group. Please help me explain why this is happening.
Thanks in advance!
I made video, showing how in clean install odoo17 this happends:
Anyone have any ideas what is going on? Even tho user demo is not in Inventory/Administrator group, it has access to stock.picking.type manager
https://youtu.be/0K1KiTlqrCk
This does seem strange but it's hard to check from the video - we can see that the user should not be able to get access, but cannot see that they are able to get access to update Operation Types. The other missing part is to check the detailed setup of the user access groups in case something has been changed there.
Access right that users get's permits all access to Picking type, so he can modify all picking time records. Question, why user get's that permission. Even tho he is not it group, that has that permission.
Unless I've misunderstood your case - I can't reproduce it in https://runbot.odoo.com (user 'demo' / password 'demo' has 'Inventory: User permission' and can't see the Inventory Configuration in menu. If the link to the Configuration page of Operation Types is known to the user s/he can see it, but still can't edit it).