This behavior has been resolved and deployed to the production environment as of 4/13/26
Summary:
Currently, it’s expected that students are able to share studio videos with any Canvas Studio groups they are members of and any instructor, TAs, instructional designers, or admins at their institution regardless of association. This is makes it so students are able to share items with users they do not have any association with, and in cases where schools are using Sub-Accounts to manage completely separate schools, it’s allowing students from one school to share items with users that belong to another separate school making it appear that they’ve shared it with someone outside of their direct instance.
Impact:
In the example of Stride, each sub-account can be a separate school that belongs to a separate state. At this time, students are able to share studio videos with any user under the Stride instance, regardless if it’s the same “school” or not, which then makes it appear like students can share videos with students who do not belong to their “school.”
Workaround:
At this time, there doesn’t seem to be any real work around to limit this. Admin can disable public links, but they cannot seem to control what users can be looked up in the search bar list.
Steps to Reproduce:
Prerequisites: At least two Studio Verified users who belong to the same instance, but separate sub-accounts.
- In a Canvas instance, create two separate sub-accounts. Create one course in each of those sub-accounts and add a verified student to one, and a verified teacher to the other.
- As the the student, open Studio and select the “Share Media” option on a video.
- On the pop-up screen, stay on the ‘People’ tab and paste the email of the verified teacher who belongs to the separate sub-account.
- Notice that the teacher does pop-up and can be selected to share the item with, even though these users have no association with each other.
