User Appears in Main Doc Despite Only Having Access to a Synced Page

Suggestion Box Bugs
1

Replicate:

  1. Create two docs: Main and Secondary
  2. Sync a page from the Main doc to the Secondary doc
  3. Grant a user Edit access to only the Secondary doc
  4. Have that user open any page in the Secondary doc (not the synced page)
    14.02.2025_16.34.30_REC

The Issue:
Even though the user (MS) does not have access to the Main doc and is not on the synced page, they still appear as an active user in the Main doc (see the screenshot above).

This is a serious privacy concern since it exposes the presence of users in a document they should not have access to.

2 Likes