Issue Summary

A user with the Administer Jira Space permission, the browse permission, but without the Manage Issue Layouts permission, can modify the order of fields in a shared layout, remove fields, and add them back. Per https://support.atlassian.com/jira-cloud-administration/docs/permissions-for-company-managed-projects/#Manage-Issue-Layouts, it should not be able to.

Steps to Reproduce

1. Add a user with the Administer Jira Space and browse permission
2. Make sure the user doesn't have the Manage Issue Layouts permission
3. Modify a shared layout.

Expected Results

Should not be able to.

Actual Results

The user can modify the fields' order, remove, and add removed fields.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available