Issue Summary

User access admins can assign product admin roles for Confluence, which potentially allows them to escalate their own privileges and gain access to spaces they should not have access to

Steps to Reproduce

1. On a site with Jira Software and Confluence, assign the user access admin role to a user for both Jira Software and Confluence. 
2. Login as the user access admin and go to User Management. 
3. Invite another user to the site 
4. Grant the Product admin role for both Jira Software and Confluence. 

The Product admin role is allowed to be granted for Confluence but not for Jira

Confluence :

 Jira

 

Suggestion

A user access admin should only be able to manage user access, and not administrator access to the products they are a user access administrator for

Workaround

Do not use the user access administrator role for Confluence, or monitor to ensure any inappropriate use is captured.