Issue Summary

This is reproducible on Data Center: Yes

Users with no linked issues permission in the parent project are able to link issues in UI, specific to the parent-child link

The application logs throw a permission error, and the issuelink table is not updated. This is causing the difference in records between the entity_property and issue link tables. 

Steps to Reproduce

• Create 2 projects, Parent & Child
• Create a new Issue type (Initiative, for example)
• Create a new Roadmaps Hierarchy level above Epic and configure the Initiative to it
• Create Users User01 and User02
• Grant User01 admin permissions on the Child project & browse issues permission alone on Parent project
• Grant User02 admin permission on Parent project & browse issues permission alone on Child project
• Login as User02 and create Initiative in Parent project
• Login as User01 and create Epic in Child Project and link the epic with Initiative in parent project using parent link or from advanced roadmap
• Reload the epic and see the parent link.
• Checking the application logs shows the below error

2025-01-14 16:01:17,570+0000 http-nio-8080-exec-5 url: /secure/AjaxIssueAction.jspa; user: user01 ERROR user01 961x8372x1 1u5j550 172.29.215.118,10.227.152.247 /secure/AjaxIssueAction.jspa [c.a.r.j.customfields.parent.ParentCustomFieldHelper] You do not have permission to link issues in this project. com.atlassian.rm.jpo.env.issues.IssueLinkServiceException: You do not have permission to link issues in this project. at com.atlassian.rm.jpo.env.issues.JiraIssueLinkService.addIssueLink(JiraIssueLinkService.java:124) at com.atlassian.rm.jpo.customfields.parent.issue.DefaultIssueParentService.createJposParentChildLink(DefaultIssueParentService.java:63) at com.atlassian.rm.jpo.customfields.parent.issue.DefaultIssueParentService.setParentIdOnCreate(DefaultIssueParentService.java:42) at com.atlassian.rm.jpo.customfields.parent.ParentCustomFieldHelper.setIssueParentOnCreate(ParentCustomFieldHelper.jav  

•  Related entries are seen in entity_property table but not in issuelink table.

Expected Results

• Error should be shown in UI that the user doesn't have the right permission to link issues and shouldn't allow the user to link issues between projects with no permission

Actual Results

•  User able to link parent-child issues between projects( where user don't have linkissue permissions on parent project) from UI
• application logs show below error

  2025-01-14 16:01:17,570+0000 http-nio-8080-exec-5 url: /secure/AjaxIssueAction.jspa; user: user01 ERROR user01 961x8372x1 1u5j550 172.29.215.118,10.227.152.247 /secure/AjaxIssueAction.jspa [c.a.r.j.customfields.parent.ParentCustomFieldHelper] You do not have permission to link issues in this project. com.atlassian.rm.jpo.env.issues.IssueLinkServiceException: You do not have permission to link issues in this project. at com.atlassian.rm.jpo.env.issues.JiraIssueLinkService.addIssueLink(JiraIssueLinkService.java:124) at com.atlassian.rm.jpo.customfields.parent.issue.DefaultIssueParentService.createJposParentChildLink(DefaultIssueParentService.java:63) at com.atlassian.rm.jpo.customfields.parent.issue.DefaultIssueParentService.setParentIdOnCreate(DefaultIssueParentService.java:42) at com.atlassian.rm.jpo.customfields.parent.ParentCustomFieldHelper.setIssueParentOnCreate(ParentCustomFieldHelper.jav  

• Related entries are seen in entity_property table but not in issuelink table.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available