Request for Marketplace add-on email notifications can be sent to inactive accounts

Summary

Users can navigate to the Atlassian Marketplace within Jira and request add-ons to be installed. This will send all groups defined under the Jira Administrators global permission an email notification indicating a particular user has requested a particular add-on.

We have observed these notifications can be sent to inactive accounts.

Steps to reproduce

• Create an account that is a member of the jira-administrators group
• Set the account as inactive ( may require an external directory )
• Request an add-on as another user

Expected behavior

Jira does not send an email notification to the inactive account

Actual behavior

Jira will generate a notification for the inactive account and attempt to deliver it

Workaround

Remove inactive accounts from all groups defined under the Jira Administrators global permission