diff --git a/CHANGELOG b/CHANGELOG
index 54f83e5aeac8be0545650e497935d5edeff54442..17b063536df66446652b381c728391aa2f7ee9dc 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,7 @@ v 8.0.0 (unreleased)
   - Allow configuration of import sources for new projects (Artem Sidorenko)
 
 v 7.14.0 (unreleased)
+  - Fix bug where non-project members of the target project could set labels on new merge requests.
   - Update default robots.txt rules to disallow crawling of irrelevant pages (Ben Bodenmiller)
   - Fix redirection after sign in when using auto_sign_in_with_provider
   - Upgrade gitlab_git to 7.2.14 to ignore CRLFs in .gitmodules (Stan Hu)
diff --git a/app/views/shared/issuable/_form.html.haml b/app/views/shared/issuable/_form.html.haml
index 3489bf3f1913edd4a1098800a186976ec9e95688..f6b09de3839b5d9325884467563d8b903d9b8688 100644
--- a/app/views/shared/issuable/_form.html.haml
+++ b/app/views/shared/issuable/_form.html.haml
@@ -38,7 +38,7 @@
       .clearfix
       .error-alert
   %hr
-- if can?(current_user, :"admin_#{issuable.to_ability_name}", @project)
+- if can?(current_user, :"admin_#{issuable.to_ability_name}", issuable.project)
   .form-group
     .issue-assignee
       = f.label :assignee_id, class: 'control-label' do