Details
-
Bug
-
Resolution: Unresolved
-
Low
-
None
-
6.3.15, 7.2.4
-
6.03
-
2
-
Severity 3 - Minor
-
0
-
Description
Summary
Jira will allow adding any user as Component Lead even if they have not any relation or access to the project.
Steps to Reproduce
- Create a new user in the JIRA Internal directory
- Remove from all groups and roles (ensure the user does not have Assignable user permission)
- Confirm that you can still assign the user as a Component Lead in a project
Expected Results
Users should not be able to assign a user who does not have Assignable user permission (project or application access). A better user experience is to limit these users to those who have access.
Actual Results
Any user can be added as a Component Lead