diff --git a/frontend/src/routes/task/Add.svelte b/frontend/src/routes/task/Add.svelte
index bdaede4b..6cb1d41e 100644
--- a/frontend/src/routes/task/Add.svelte
+++ b/frontend/src/routes/task/Add.svelte
@@ -51,25 +51,21 @@
     }
 
     async function load(){
-        console.log({assignee});
         if (parent_task_id) await loadParent();
-        if (project_id) await loadProject();
+        if (project_id) loadProject();
         if (state_id)   task.status   = { code : +state_id };
-        await loadTags();
-        console.log({task:JSON.parse(JSON.stringify(task))});
+        loadTags();
     }
 
     async function loadParent(){
-        console.log('loading parent task with id = '+parent_task_id);
         const url  = api(`task/${parent_task_id}`);
         const resp = await get(url);
         if (resp.ok){
             parent_task         = await resp.json();
-            console.log(JSON.parse(JSON.stringify(parent_task)));
             task.parent_task_id = +parent_task_id;
             for (let [uid, member] of Object.entries(parent_task.members)){
+                if (['OWNER','ASSIGNEE'].includes(member.permission.name)) member.permission = { name: 'EDIT', code: 2 };
                 task.members[uid] = member;
-                console.log('added member from parent task to new task: '+member.user.name+' ('+member.permission.name+')');
             }
             project_id          = +parent_task.project_id;
             yikes();
@@ -78,17 +74,15 @@
     }
 
     async function loadProject(){
-        console.log('loading project '+project_id);
         const url  = api(`project/${project_id}`);
         const resp = await get(url);
         if (resp.ok){
             project           = await resp.json();
-            console.log(JSON.parse(JSON.stringify(project)));
             task.project_id   = +project_id;
             if (Object.keys(task.members).length < 1) {
                 for (let [uid, member] of Object.entries(project.members)){
+                    if (['OWNER','ASSIGNEE'].includes(member.permission.name)) member.permission = { name: 'EDIT', code: 2 };
                     task.members[uid] = member;
-                    console.log('added member from project to new task: '+member.user.name+' ('+member.permission.name+')');
                 }
             }
             if (assignee && project.members[assignee]){
@@ -103,11 +97,9 @@
     }
 
     async function loadTags(){
-
         let url = null;
         if (project_id) url = api(`tags/project/${project_id}`);
         if (parent_task_id) url = api(`tags/task/${parent_task_id}`);
-        console.log('loading tags: ',url);
         if (url) {
             const resp = await get(url);
             if (resp.ok) task.tags = await resp.json();
@@ -122,7 +114,6 @@
     }
 
     async function saveTask(){
-        console.log({task:JSON.parse(JSON.stringify(task))});
         const url  = api('task/add');
         const resp = await post(url,task);
         if (resp.ok) {
@@ -143,6 +134,10 @@
         extendedSettings = !extendedSettings;
     }
 
+    function updatePermission(uid,perm){
+        task.members[uid].permission = perm;
+    }
+
     onMount(load);
 </script>
 
@@ -180,7 +175,7 @@
         {#if extendedSettings}
         <div>{t('members')}</div>
         <div>
-            <PermissionEditor members={task.members} {addMember} {dropMember} {getCandidates} />
+            <PermissionEditor members={task.members} {addMember} {dropMember} {getCandidates} {updatePermission} />
         </div>
 
         <div>{t('estimated_time')}</div>
diff --git a/task/src/main/java/de/srsoftware/umbrella/task/TaskModule.java b/task/src/main/java/de/srsoftware/umbrella/task/TaskModule.java
index 1e49f5a7..a7071e29 100644
--- a/task/src/main/java/de/srsoftware/umbrella/task/TaskModule.java
+++ b/task/src/main/java/de/srsoftware/umbrella/task/TaskModule.java
@@ -386,40 +386,33 @@ public class TaskModule extends BaseHandler implements TaskService {
 		long projectId = pid.longValue();
 		var project = projectService().load(projectId);
 		projectService().loadMembers(List.of(project));
-		var members = project.members();
-		var member = members.get(user.id());
+		var parentMembers = project.members();
+		var member = parentMembers.get(user.id());
 		if (member == null || member.permission() == READ_ONLY) throw forbidden("You are not allowed to create new tasks in this project");
 
 		var parentTask = json.has(PARENT_TASK_ID) && json.get(PARENT_TASK_ID) instanceof Number par ? taskService().load(Set.of(par.longValue())).get(par.longValue()) : null;
 		if (parentTask != null) {
 			taskService().loadMembers(parentTask);
-			members = parentTask.members();
-			member = members.get(user.id());
+			parentMembers = parentTask.members();
+			member = parentMembers.get(user.id());
 			if (member == null || member.permission() == READ_ONLY) throw forbidden("You are not allowed to add sub-stasks to {object}", OBJECT, parentTask.name());
 		}
 
 		var newMembers = new HashMap<Long, Permission>();
-		for (var mem : members.values()) { // Assign members from project or parent task
-			var permission = mem.permission() == OWNER ? EDIT : mem.permission();
-			newMembers.put(mem.user().id(), permission);
-		}
-
-		if (json.has(MEMBERS) && json.get(MEMBERS) instanceof JSONObject mems) {
-			// check of assignee has been set by client
-			for (var k : mems.keySet()) {
-				try {
-					var userId = Long.parseLong(k);
-					var permName = mems.getJSONObject(k).getJSONObject(PERMISSION).getString(NAME);
-					if (Permission.valueOf(permName) == ASSIGNEE) newMembers.put(userId, ASSIGNEE);
-				} catch (Exception ignored) {
-					LOG.log(WARNING, "Failed to parse {0}", mems.get(k));
-				}
+		if (json.has(MEMBERS) && json.get(MEMBERS) instanceof JSONObject members) {
+			for (var key : members.keySet()){
+				var code = members.getJSONObject(key).getJSONObject(PERMISSION).getInt(CODE);
+				var perm = Permission.of(code);
+				if (perm == OWNER) perm = EDIT;
+				var userId = Long.parseLong(key);
+				if (!parentMembers.containsKey(userId)) throw forbidden("{user} is not a member of {path}",Field.USER,userService().loadUser(userId).name(),Field.PATH, parentTask == null ? project.name() : parentTask.name());
+				newMembers.put(userId,perm);
 			}
 		}
+
 		// set ownership to current user
 		newMembers.put(user.id(), OWNER);
 
-
 		json.put(MEMBERS, Map.of()); // reset member map for task-to-be-created
 		Task task = Task.of(json);
 		if (parentTask != null && parentTask.dueDate() != null && task.dueDate() == null) task.dueDate(parentTask.dueDate());