Fix ticket observer can edit additional fields

CHANGELOG.md

@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - Fix mandatory fields of a block hidden by its display conditions blocking the save of an item
 - Fix fields values updates not applying the expected checks in some cases
 - Fix `Yes/No` field values returned as strings instead of integers in search results
+- Fix ticket observers being able to edit and save additional fields they are not allowed to modify
 
 ## [1.24.6] - 2026-10-06
 

inc/container.class.php

@@ -2074,6 +2074,21 @@ public static function preItemUpdate(CommonDBTM $item)
     {
         self::preItem($item);
         if (array_key_exists('_plugin_fields_data', $item->input)) {
+            // Only save plugin fields if the user can update this specific item.
+            // Automated contexts (cron jobs, API without active profile) bypass this check.
+            if (
+                isset($_SESSION['glpiactiveprofile']['id'])
+                && !$item->canUpdateItem()
+            ) {
+                unset($item->input['_plugin_fields_data']);
+                Session::addMessageAfterRedirect(
+                    __('You do not have the right to modify the fields of this item', 'fields'),
+                    false,
+                    WARNING,
+                );
+                return true;
+            }
+
             $data = $item->input['_plugin_fields_data'];
             $data['itemtype'] = $item::class;
             $data['entities_id'] = $item->isEntityAssign() ? $item->getEntityID() : 0;

inc/field.class.php

@@ -891,7 +891,7 @@ public static function showForTabContainer($c_id, $item)
             return null;
         }
 
-        $canedit = $right > READ;
+        $canedit = $right > READ && ($item->isNewItem() || $item->canUpdateItem());
 
         //get fields for this container
         $field_obj = new self();
@@ -1213,7 +1213,7 @@ public static function prepareHtmlFields(
             return null;
         }
 
-        $canedit = $right > READ;
+        $canedit = $right > READ && ($item->isNewItem() || $item->canUpdateItem());
 
         // Fill status overrides if needed
         if (in_array($item->getType(), PluginFieldsStatusOverride::getStatusItemtypes())) {