Bug 40001

Summary: edit_items permission allows deletion of individual items. Should be separate.
Product: Koha Reporter: Hanan Mustafa <hananmustafaawan>
Component: CatalogingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, m.de.rooy
Version: 24.11   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Hanan Mustafa 2025-05-27 05:12:20 UTC
Currently, the edit_items permission allows a user to delete individual items using the "Action" button on the edit item page.

This behavior persists even when the user does not have the delete_all_items permission, which is intended (according to documentation) to manage bulk deletion.

This creates a permissions flaw: staff with rights to edit items can also delete items, which may not always be desirable from a library’s operational or security perspective.

Steps to Reproduce:
Create a staff account with only the edit_items permission (without delete_all_items)

Go to: catalogue/itemsearch.pl

Edit an item (via cataloguing/additem.pl?op=edititem&...)

Click the Action button, then Delete the item

The item is deleted successfully — despite lacking delete_all_items permission

Expected Behavior:
There should be a separate delete_items permission for deleting individual items
OR
Deleting any item (individual or bulk) should require the delete_all_items permission.