Method AssigneeSystemField#validateParams is used to validate Assignee for multiple IssueService methods e.g.:

• validateAssign
• validateUpdate

It's supposed to get ApplicationUser user from these methods for validation (checking Assign Issues permission in particular). However, currently it doesn't and checks the permission against the current logged-in user instead:

hasPermission(ProjectPermissions.ASSIGN_ISSUES, issue, getAuthenticationContext().getLoggedInUser())

This is a bug in which:

• The current logged-in user may be anyone and the validation may pass in an unexpected way if this user has Assign Issues permission
• In case this user doesn't have the permission, this error is thrown regardless:

  You do not have permission to assign issues.