### **Environment**:

Begin of the insertionOP 11.2End of the insertion Begin of the deletion Your OpenProject Version: <VERSION> / Cloud EditionEnd of the deletion

Begin of the deletion Operating System / Browser / OpenProject language:

End of the deletion ### Begin of the deletion **Logs**

Are there errors in the browser console? ([Click here for information on how to open your browser's console](https://webmasters.stackexchange.com/a/77337)) For a local installation: Are there relevant logs output by `openproject logs` (packaged installation) or in a log/production.log or /var/log/openproject/ ? Please attach error output in these log files if applicable

###End of the deletion **Steps to reproduce:**

1. Begin of the insertionCreate a non-admin user "Leaker" with the global permissionEnd of the insertion Begin of the deletion GoEnd of the deletion to Begin of the insertioncreate and edit usersEnd of the insertion Begin of the deletion page XEnd of the deletion
2. Begin of the insertionMake that user a normal member of a project "A", without the right to manager members of that projectEnd of the insertion Begin of the deletion Click on button YEnd of the deletion
3. Begin of the insertionLogin as that user.
4. Go to administration > Users, 
5. Chose to edit some other user. Go to projects tab.End of the insertion Begin of the deletion Select FooEnd of the deletion

### **Actual Behavior**

Begin of the insertion* inEnd of the insertion Begin of the deletion DescribeEnd of the deletion the Begin of the insertionprojects drop down on the right you see project "A" although you should not be able to manage memberships of that project.
* you can now add that other user with any role to that project "A"End of the insertion Begin of the deletion behavior you're seeing.End of the deletion

### **Expected Behavior**

Begin of the insertion* you should not be able to see and select project "A" in that drop down
* The backend should not accept addingEnd of the insertion Begin of the deletion DescribeEnd of the deletion the Begin of the insertionmember to project "A".End of the insertion Begin of the deletion expected behavior.End of the deletion