diff --git a/app/controllers/watchers_controller.rb b/app/controllers/watchers_controller.rb
index 13ede5d75..8402d1b53 100644
--- a/app/controllers/watchers_controller.rb
+++ b/app/controllers/watchers_controller.rb
@@ -175,8 +175,9 @@ class WatchersController < ApplicationController
     q = params[:q].to_s.strip
 
     scope = nil
-    if params[:q].blank? && @project.present?
-      scope = @project.principals.assignable_watchers.limit(100)
+    if @project.present?
+      scope = @project.principals.assignable_watchers
+      scope = scope.limit(10) if params[:q].present?
     else
       scope = Principal.assignable_watchers.limit(10)
     end
diff --git a/lib/redmine/acts/mentionable.rb b/lib/redmine/acts/mentionable.rb
index 5efa5aa67..cfdd0af14 100644
--- a/lib/redmine/acts/mentionable.rb
+++ b/lib/redmine/acts/mentionable.rb
@@ -71,7 +71,11 @@ module Redmine
           new_matches = (current_matches - previous_matches).flatten
 
           if new_matches.any?
-            self.mentioned_users = User.visible.active.where(login: new_matches)
+            scope = User.visible.active.where(login: new_matches)
+            if respond_to?(:project) && project
+              scope = scope.where(admin: true).or(scope.where(id: project.principals.select(:id)))
+            end
+            self.mentioned_users = scope
           end
         end
 
diff --git a/test/functional/watchers_controller_test.rb b/test/functional/watchers_controller_test.rb
index 62a5e5955..638ff38d5 100644
--- a/test/functional/watchers_controller_test.rb
+++ b/test/functional/watchers_controller_test.rb
@@ -481,6 +481,20 @@ class WatchersControllerTest < Redmine::ControllerTest
     assert_equal ['dlopper', 'jsmith'], response.parsed_body.pluck('login')
   end
 
+  def test_autocomplete_for_mention_with_query_should_not_return_users_outside_the_project
+    # "someone" (id: 7) does not belong to any project
+    @request.session[:user_id] = 1
+    get :autocomplete_for_mention, params: {
+      project_id: 'ecookbook',
+      object_type: 'issue',
+      object_id: '1',
+      q: 'someone'
+    }, xhr: true
+
+    assert_response :success
+    assert_equal [], response.parsed_body.pluck('login')
+  end
+
   def test_autocomplete_for_user_should_not_return_users_without_object_visibility
     @request.session[:user_id] = 1
     get :autocomplete_for_user, :params => {
diff --git a/test/unit/lib/redmine/acts/mentionable_test.rb b/test/unit/lib/redmine/acts/mentionable_test.rb
index 00a7df159..ec70c0e02 100644
--- a/test/unit/lib/redmine/acts/mentionable_test.rb
+++ b/test/unit/lib/redmine/acts/mentionable_test.rb
@@ -72,6 +72,13 @@ class Redmine::Acts::MentionableTest < ActiveSupport::TestCase
     assert_equal [User.find(2)], issue.mentioned_users
   end
 
+  def test_mentioned_users_should_not_include_users_outside_the_project
+    # "someone" (id: 7) does not belong to any project
+    issue = Issue.generate!(project_id: 1, description: '@jsmith @someone')
+
+    assert_equal [User.find(2)], issue.mentioned_users
+  end
+
   def test_mentioned_users_should_not_include_mentioned_users_in_existing_content
     issue = Issue.generate!(project_id: 1, description: 'Hello @dlopper')