diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index ae7429ef..f4975672 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1075,8 +1075,12 @@ async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: Db err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code); } - if !headers.membership.has_full_access() { - err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); + if !headers.membership.has_full_access() && !headers.membership.has_access_reports() { + err_code!( + "Resource not found.", + "User does not have permission to access all organization ciphers", + rocket::http::Status::NotFound.code + ); } Ok(Json(json!({