Issue Summary

Disabled values of custom field options can still be updated via PUT Edit issue REST API request.

Steps to Reproduce

1. Create a select list custom field.
2. Add multiple options.
3. Disable one option and ensure that it is not displayed on the screens.
4. Run the following REST request

   curl -D- -X PUT \
   --url 'https://<YourInstance>.atlassian.net/rest/api/3/issue/<Issue Key>' \
   --user 'email:token' \
   --header 'Accept: application/json' \
   --header 'Content-Type: application/json' \
   --data '{"fields": {"customfield_<ID>": {"id": "<Disabled Option ID>"}}}'
   

Expected Results

Only non-disabled entries should be updated.

Actual Results

All the custom field values can be updated. Including the disabled ones.

Workaround

Currently, there is no known workaround for this behaviour. A workaround will be added here when available