Issue Summary

A Jira form can be opened from a URL containing a different space key than the space where the form was created. For example, a form with ID 123 created in space ABC opens successfully when using both of the following URLs:

• https://site.atlassian.net/jira/software/projects/ABC/form/123

• https://site.atlassian.net/jira/software/projects/DEF/form/123

This is confusing because the form is space-scoped and does not exist in the DEF space. The URL appears to resolve the form by form ID without validating that the space key in the URL matches the form’s owning space.

Steps to Reproduce

1. Create a Jira form in space ABC, and note its ID.

1. Open the form using the correct space key in the URL: https://site.atlassian.net/jira/software/projects/ABC/form/123

1. Replace the space key in the URL with another space key where the form was not created, for example: https://site.atlassian.net/jira/software/projects/DEF/form/123

1. Observe that the same form opens even though the form does not exist in the DEF space.

Expected Results

The form should not open when the space key in the URL does not match the space where the form was created. Jira should either show an appropriate error/not-found message or redirect to the correct space context where the form belongs.

Actual Results

The same form opens successfully even when the URL contains a space key for a different space where the form does not exist.

Workaround

Currently, there is no known workaround for this behavior.

However, the Space admin can restrict the space permissions to prevent users from creating work items in the wrong space through forms.