An user is unable to edit an issue because he has no rights to set the seucurity level while this field is required.
The field already has a value so it seems strange that this nevertheless results in an error.
Probably the same (underlying) problem as JRA-5783.