# Bug: mails are sent to disabled users
**URL:** https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960
**Category:** Forum - Software
**Tags:** bug
**Created:** [January 8, 2025, 8:03am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960 "2025-01-08T08:03:59Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Embezzle](https://discussions.eramba.org/u/Embezzle)
#### Post date: [January 8, 2025, 8:03am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/1 "2025-01-08T08:03:59Z")
# What version of eramba you are using (System / About)
3.25.1
# A brief explanation of the issue
Notification mails get sent to users that are disabled. We only send to groups, so it’s is currently unclear if this is a general bug or only for notifications sent to groups. When an employee leaves the company, we disable the account and leave it as it was to remain the audit trail. We could remove that user from all groups to avoid the user still receiving mails via groups but the described behaviour is unexpected and unseen in other software. A disabled user should not only be prohibited from logging in but also from getting notifications.
# What steps, one by one, including screenshots if needed, we must follow in order to reproduce the issue
- create a user
- add that user to a group
- disable that user
- trigger an action that sends a notification email to that group
- the user will receive the email
---
### Author:  [@kisero](https://discussions.eramba.org/u/kisero)
#### Post date: [January 8, 2025, 9:09am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/2 "2025-01-08T09:09:09Z")
phew, top bug documentation
---
### Author:  [@Embezzle](https://discussions.eramba.org/u/Embezzle)
#### Post date: [January 8, 2025, 11:11am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/3 "2025-01-08T11:11:45Z")
top bug documentation in → top bug resolution out 😃
---
### Author:  [@david.schroth](https://discussions.eramba.org/u/david.schroth)
#### Post date: [January 9, 2025, 4:50am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/4 "2025-01-09T04:50:12Z")
I think this would bug me
---
### Author:  [@sam](https://discussions.eramba.org/u/sam)
#### Post date: [January 10, 2025, 7:59am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/5 "2025-01-10T07:59:32Z")
Int. ref.: [https://github.com/eramba/eramba/issues/5011](https://github.com/eramba/eramba/issues/5011)
---
### Author:  [@Embezzle](https://discussions.eramba.org/u/Embezzle)
#### Post date: [May 18, 2026, 3:34pm UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/7 "2026-05-18T15:34:47Z")
This is still not fixed, although it is quite an easy implementation. When can we expect this to be fixed? In my book sending notifications with details to disabled users is a CWE-200 vulnerability - so rather problematic instead of a mere minor issue that exists 1,5 years after it was reported. Especially considering this is a GRC/security relevant tool.
---
### Author:  [@Adrian](https://discussions.eramba.org/u/Adrian)
#### Post date: [May 18, 2026, 5:07pm UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/8 "2026-05-18T17:07:14Z")
This was fixed in release 3.27.0
> [@Release 3.27.0](https://discussions.eramba.org/t/release-3-27-0/6167):
>
> As part of this release, we’ve updated PHP, MySQL, and Redis versions to keep your environments secure and up to date. Please note: On-premise users will need to coordinate with their sys-admins, since an “[image switch](https://www.eramba.org/learning/courses/12/episodes/326#Image%2520switch%2520procedure)” procedure from the command line is required. You’ll also need to update your [Docker repository](https://discussions.eramba.org/t/updating-the-docker-repository-for-release-3-27-0/7521) to the latest version. The image can be downloaded directly from our [download portal](https://downloads.eramba.org/downloads/login). Users running non-Dockerized versions must update dependencies manually on their servers. Si…
I tested right now on 3.29.1 and it works fine; no email is generated when the user is disabled.
Notification runs as expected but no email is sent, and there’s no entry in queue emails.
Happy to take a look again if I am missing something 🙂
---
### Author:  [@Embezzle](https://discussions.eramba.org/u/Embezzle)
#### Post date: [May 19, 2026, 7:36am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/9 "2026-05-19T07:36:23Z")
We are on 3.29.1 and mails are still sent to disabled users. I assume you have tested this with a local user? In our setup we use SAML - maybe the bug still exists for non-local users?
Here’s the disabled user. In order for him not to receive the mails anymore, I implemented a workaround by suffixing the email address with a “.DISABLED”.
And here’s a notification sent for a policy review comment. As you can see the user is part of the recipients.
Here’s how the notification is set up:
---
### Author:  [@Adrian](https://discussions.eramba.org/u/Adrian)
#### Post date: [May 21, 2026, 3:39pm UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/10 "2026-05-21T15:39:46Z")
I tested both types with non-local recipients and got the same result, but I figured out what I was doing differently. I was using the group directly as the recipient. I managed to reproduce it when using custom roles, so this definitely needs to be fixed.
internal ref:[Jira](https://eramba-team.atlassian.net/browse/ERB-1514)
---
### Author:  [@Embezzle](https://discussions.eramba.org/u/Embezzle)
#### Post date: [May 22, 2026, 7:31am UTC](https://discussions.eramba.org/t/bug-mails-are-sent-to-disabled-users/5960/11 "2026-05-22T07:31:03Z")
Thanks, I’m glad it wasn’t just me 🙂