Issue Summary

Jira allows users to manage sprints in circumstances that they should not be to do so.

Steps to Reproduce

1. With User A (that is not a Jira Administrator) create a board (Original Board) with a filter query that is comprised of two different projects, let's say project in (A,B).
2. Do not share the filter query for the Original Board with anyone.
3. Create a sprint on this board and only include issues from project A.
4. Create a second board, let's call it Secondary Board, using the Board from an existing project option, and select only project A.
5. Remove User A's Manage Sprints permission from project B. Ensure that User A has the Browse Projects permission in project B.
6. Attempt to close the sprint with User A. This user will be unable to close the sprint and the You need the manage sprint permission for all projects in the origin board to manage this sprint.
7. Create a secondary user: User X and add this user to the same user management groups and project roles, ensuring that he has the same permissions as user A in both projects.
8. Attempt to close the same sprint.

Expected Results

• User B will not be able to complete the sprint, displaying a similar behavior to User A.

Actual Results

• User B can complete the sprint without any issues, as we can see in the screenshot below:

If you share the filter query of the Secondary Board with User B he will lose the ability to complete the sprint as well.

Workaround

Currently, there is no known workaround for this behavior, other than creating the sprint directly in the Secondary Board.