From 5bf1792b385939e82f0d5df4112ea96023ade9bc Mon Sep 17 00:00:00 2001
From: Mike Cao <mike@umami.is>
Date: Tue, 2 Jun 2026 22:17:10 -0700
Subject: [PATCH] Restrict team owner assignment to admins

---
 src/app/api/teams/route.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/app/api/teams/route.ts b/src/app/api/teams/route.ts
index 6c79be7fc..43fe235d8 100644
--- a/src/app/api/teams/route.ts
+++ b/src/app/api/teams/route.ts
@@ -47,7 +47,7 @@ export async function POST(request: Request) {
   const { name, ownerId } = body;
 
   const teamId = uuid();
-  const teamOwnerId = ownerId ?? auth.user.id;
+  const teamOwnerId = ownerId && auth.user.isAdmin ? ownerId : auth.user.id;
 
   const team = await createTeam(
     {