Why can restricted permission scheme users see projects they're not added to on the create modal?

[Jonathan Ward]

This is a serious issue when you work with teams that you don't want to have visibility of all your projects.

Any user with access to our Jira Software can click create from the header navigation and see a full list of projects to choose from within the project select dropdown option.

This is a major data security issue in terms of allowing users to view projects they're not explicitly added too within the permissions schemes.

[Petr AST · Accepted solution]

Hi @Jonathan Ward 

Can you please check "Create issue" permission and remove everyone except project participants. In this case, the project will disappear from the selection list for the rest when creating a task

[Jonathan Ward]

It was the default software scheme that had access to all logged in users enabled on create issues. Frustrating but thanks for assisting.

[Joe Pitt · Accepted solution]

Sounds like they are in a group that has permission. I don't know about Cloud, but in the server version by default everyone who has an ID is in a group given access to all projects. 

[Jonathan Ward]

It was the default software scheme that had access to all logged in users enabled on create issues. Appreciate you trying to assist.

[Trudy Claspill]

Hello @Jonathan Ward 

Welcome to the Atlassian community.

Have you confirmed that the users don't have the Browse Permission for Company Managed projects they should not be able to see? If you have Team Managed projects also, then the Project Access on those projects needs to be set to Private.

[Jonathan Ward]

The issue was all logged in users permission on default software scheme.