Apache Zeppelin笔记本访问控制异常：非所有者可添加自身为所有者

I’ve run into this exact permission issue with Apache Zeppelin and can confirm the behavior you’re seeing. Let me break down the exact steps to replicate it and the unexpected outcome:

Steps to Reproduce the Issue #

• Log in to Apache Zeppelin using the user1 account, then create a notebook named MyNote1
• Navigate to the notebook’s access control settings and update them to:
  • Owner: user1
  • Readers: user1, user2
  • Writers: user1
• Log out of user1’s account, then log back in as user2

Abnormal Behavior Observed #

Based on the configured permissions, user2 should only have read-only access to MyNote1—meaning they can view the notebook but shouldn’t modify its permissions. However, in practice, user2 is able to click the "Note Permissions" icon, add themselves as the notebook’s owner, and gain full control over the notebook.

内容的提问来源于stack exchange，提问作者Data Analyst