Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-76172

Users with no "Browse Users permissions" are able to fetch issues which are assigned to another user or reported by other user using advanced search filter

XMLWordPrintable

      Issue Summary

      Users with no "Browse Users permissions" are able to fetch issues which are assigned to another user or reported by other user using advanced search filter.

      This is reproducible on Data Center: yes

      Steps to Reproduce

      1. Log into JIRA with a user which does not have Browse Users permissions
      2. Use basic search filter to search for issues which are assigned to another user or are reported by another user
      3. Also, use the advanced search filter to search for issues which are assigned to another user or are reported by another user

      Expected Results

      Users with no Browse Users permissions should not be allowed to fetch issues which are assigned to another user or are reported by another user. However, when search is performed by JQL the details can be fetched, though it fails when using basic search.

      Actual Results

      With Basic search the operation fails with response code 403 and error message that the user is not authorized.

      Advanced search with JQL does shows response code as 400 and error message that the user is not authorized but still the issue details can be fetched.

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

        1. image-2023-08-17-14-59-08-274.png
          454 kB
          Yash Singh
        2. image-2023-08-17-14-58-50-194.png
          530 kB
          Yash Singh
        3. image-2023-08-17-14-57-08-770.png
          410 kB
          Yash Singh
        4. image-2023-08-17-14-56-38-150.png
          383 kB
          Yash Singh

              Unassigned Unassigned
              808188ae9fff Yash Singh
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: