diff --git a/awx/main/access.py b/awx/main/access.py index 674e04ce39..184f940614 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -1232,9 +1232,11 @@ class TeamAccess(BaseAccess): Organization.access_qs(self.user, 'change').exists() or Organization.access_qs(self.user, 'audit').exists() ): return self.model.objects.all() - return self.model.objects.filter( - Q(organization__in=Organization.accessible_pk_qs(self.user, 'member_role')) | Q(pk__in=self.model.accessible_pk_qs(self.user, 'read_role')) + org_member_teams = ( + self.model.objects.filter(organization__in=Organization.accessible_pk_qs(self.user, 'member_role')).order_by().values_list('pk', flat=True) ) + direct_read_teams = self.model.objects.filter(pk__in=self.model.accessible_pk_qs(self.user, 'read_role')).order_by().values_list('pk', flat=True) + return self.model.objects.filter(pk__in=org_member_teams.union(direct_read_teams)) @check_superuser def can_add(self, data):