diff --git a/src/common/rbac/project/rbac_role.go b/src/common/rbac/project/rbac_role.go
index fa618b982758..a98ccd2e5acb 100644
--- a/src/common/rbac/project/rbac_role.go
+++ b/src/common/rbac/project/rbac_role.go
@@ -122,10 +122,7 @@ var (
 			{Resource: rbac.ResourceMember, Action: rbac.ActionRead},
 			{Resource: rbac.ResourceMember, Action: rbac.ActionList},
 
-			{Resource: rbac.ResourceMetadata, Action: rbac.ActionCreate},
 			{Resource: rbac.ResourceMetadata, Action: rbac.ActionRead},
-			{Resource: rbac.ResourceMetadata, Action: rbac.ActionUpdate},
-			{Resource: rbac.ResourceMetadata, Action: rbac.ActionDelete},
 
 			{Resource: rbac.ResourceLog, Action: rbac.ActionList},
 
diff --git a/src/pkg/task/dao/task.go b/src/pkg/task/dao/task.go
index 177738561891..b42781c17a9f 100644
--- a/src/pkg/task/dao/task.go
+++ b/src/pkg/task/dao/task.go
@@ -114,8 +114,8 @@ func (t *taskDAO) ListScanTasksByReportUUID(ctx context.Context, uuid string) ([
 	}
 
 	var tasks []*Task
-	param := fmt.Sprintf(`{"report_uuids":["%s"]}`, uuid)
-	sql := `SELECT * FROM task WHERE extra_attrs::jsonb @> cast( ? as jsonb )`
+	param := fmt.Sprintf(`"%s"`, uuid)
+	sql := `SELECT * FROM task WHERE extra_attrs::jsonb -> 'report_uuids' @> ?`
 	_, err = ormer.Raw(sql, param).QueryRows(&tasks)
 	if err != nil {
 		return nil, err