diff --git a/Marco.Pms.Services/Controllers/TenantController.cs b/Marco.Pms.Services/Controllers/TenantController.cs index 2313a8c..80366ab 100644 --- a/Marco.Pms.Services/Controllers/TenantController.cs +++ b/Marco.Pms.Services/Controllers/TenantController.cs @@ -290,7 +290,7 @@ namespace Marco.Pms.Services.Controllers } _logger.LogInfo("Tenant {TenantId} found.", tenant.Id); - if (!hasManagePermission && (hasModifyPermission || hasViewPermission) && tenant.OrganizationId != loggedInEmployee.OrganizationId) + if (!hasManagePermission && (tenant.OrganizationId != loggedInEmployee.OrganizationId && !(hasModifyPermission || hasViewPermission))) { _logger.LogWarning("Permission denied: User {EmployeeId} attempted to access tenant details of other tenant.", loggedInEmployee.Id); return StatusCode(403,