A big privacy issue...!

[Foddy]

Hi,

we are using the PRO version of Poste.io and recently found a big privacy issue in the web admin UI. We have multiple domain admins and customers, who should be allowed to manage and see only their own domain.

This is what they can see in the most recent version, when they try to change an address:

A complete list of all our customers and domains. I hope that this will be fixed as soon as possible. Various data protection regulations in the EU and internal company privacy policies prohibit this access to all domains for external administrators.

[SH]

fix #808 allow changing box domain super admin only

→ <<cset e4af8d325dd6>>