Security Issue - Any User can edit voting permissions

[rossbuggins]

Hi, just trying this out, but it seems that any VSO user can goto project permissions, extensions and then update the voting settings?

[barbara-goeller]

Hi,

Sorry for the late answer. We are aware of this behaviour. Currently there is no permission concept considering the role of a user within a team project.

A permission based access may be implemented at a later point of time. If you want to you can implement it yourself and create a pull request.

Best regards
Barbara