1 files changed, 8 insertions, 1 deletions

diff --git a/app/services/issues/reorder_service.rb b/app/services/issues/reorder_service.rb
index 1013c3dc20b..7b8cc36607d 100644
--- a/app/services/issues/reorder_service.rb
+++ b/app/services/issues/reorder_service.rb
@@ -2,8 +2,9 @@
 
 module Issues
   class ReorderService < Issues::BaseService
-    def execute(issue, group = nil)
+    def execute(issue)
       return false unless can?(current_user, :update_issue, issue)
+      return false if group && !can?(current_user, :read_group, group)
 
       attrs = issue_params(group)
       return false if attrs.empty?
@@ -13,6 +14,12 @@ module Issues
 
     private
 
+    def group
+      return unless params[:group_full_path]
+
+      @group ||= Group.find_by_full_path(params[:group_full_path])
+    end
+
     def update(issue, attrs)
       ::Issues::UpdateService.new(project, current_user, attrs).execute(issue)
     rescue ActiveRecord::RecordNotFound