User without Jira Administrator permission could change permission scheme

[Bastian Stehmann]

Hi,

we had some weird thing happen in our Jira instance.

I just noticed in our audit log, that a user, who does not have Jira Administrator or Jira System Administrator permission, copied and changed the permission scheme of a project.

The user is a project administrator, but we are running 7.3.8 where it is not possible to grant the extended project administration permissions.

Also the user says, that he didn't do that and he couldn't find a way to do this now.

So we don't know, if he did it somewhen and just forgot it, or if the audit log is listing a wrong user.

Did you experience something like that?

[Daniel Cicciarelli]

Could it be a global permission setting? 

You could validate it from revising the "Configure permissions in user management" link and validating which roles / groups are currently assigned.

All I can think of for now. 

[Bastian Stehmann]

Hi @Daniel Cicciarelli ,

thanks for your reply.

We checked that already, but the user is not (and according to the audit log has never been) member of any group with jira administration permissions.

[Daniel Cicciarelli]

Sounds like an interesting case, sorry I cannot be of any more help. 

Only other thing I would check / suggest is to look at the specific project the user is allocated to and view the project settings and then the people menu just to rule out project specific roles.

Good luck either way, I am keen to see how this one unfolds.

Dan