Permission "Users - manage students in courses" allows users to remove students/observers from courses

[#1]

This behavior is resolved in the 2021-12-01 deploy.

Known issues indicate notable behaviors that has been escalated to the Canvas engineering team. Known issues are not a guarantee for an immediate resolution. This document is for informational purposes only and does not replace the Support process. If you are encountering the behavior outlined in this document, please ensure you have submitted a Support case (per your institution's escalation process) so Canvas Support can adequately gauge the overall customer impact and prioritize appropriately.

Description

When permission "Users - manage students in courses" is enabled, it allows users to remove students and observers from courses.

Expected Behavior

Instead, it should not allow you to remove students or observers from courses as permission "Users - Student/Observers" needs to be enabled.

Workaround

No workaround exists at this time.

Steps to Reproduce

1. Create a role with with only permissions "Users - manage students in courses" and "Users - view list" enabled.

2. Enroll a user using into the course with the role.

3. Add a student and observer into the course.

4. Go to the peoples page as the teacher and you will see that you will be able to remove the student and observer from the course, even though permissions "Users - Student/Observers" is disabled.

Additional Info

FOO-2484