1

I have set my Account to Private. I have Activity (Task) set to Private

I have two users - Joe Schmoe and Karen Hoyts.

I have created an account Joe's Account. Under that account, i create a task Karen's task and assign it to Karen Hoyts.

Using the UI, Karen can see the account name on that task, but when she clicks on it, she gets

Looks like there's a problem. Unfortunately, there was a problem. Please try again. If the problem continues, get in touch with your administrator with the error ID shown here and any other related details. The requested resource does not exist

(that is good and expected).

Now, using the REST API (the standard REST API, /services/data/v48.0/query), i run the query as Karen

SELECT Id, Account.Name, Account.My_Custom_Field__c FROM Task WHERE Id = '<<task id here>>'

And boom -> Karen just pulled out data from Account that she does not have sharing to.

Why is that?

Improve this question
10
  • Are you using standard rest api or from apex ?
    – Mohith Shrivastava
    Apr 23 '20 at 2:04
  • Standard REST API
    – zaitsman
    Apr 23 '20 at 2:04
  • How are you running the API as Karen
    – identigral
    Apr 23 '20 at 2:58
  • @identigral There is a connected app in the org, Karen authorised that and i get an access token. I can use her access token to issue queries to REST API.
    – zaitsman
    Apr 23 '20 at 3:16
  • I do not see this behavior actually. It prints null for other fields.I think something is wrong in your testing
    – Mohith Shrivastava
    Apr 23 '20 at 3:39
0

I think it has to do with Access Grants, specifically Implicit Grants.

Grants that occur when non-configurable record-sharing behaviors built into Salesforce Sales, Service, and Portal applications grant access to certain parent and child records. For example, with this default logic, sometimes referred to as built-in sharing, users can view a parent account record if they have access to its child opportunity, case, or contact record. If those users have access to a parent account record, they can also access its child opportunity, case, and contact records.

Improve this answer
3
  • If that were the case, would i not be able to access this record via UI also?
    – zaitsman
    Apr 23 '20 at 2:14
  • As Karen, you can see the account name on the task record. This tells me you can see any account related data on the task, which is what your query is doing. Try querying for the account record as Karen. You shouldn't be able to query it.
    – Tyler Zika
    Apr 23 '20 at 2:30
  • 1
    Correct, i can not query the record directly, but i can download ALL the fields using navigational properties (Account.X).
    – zaitsman
    Apr 23 '20 at 2:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.