User can link tickets out of there projects

Question

Hey together,

currently, users can link to issues whose project they do not have access to.

Is there a way to restrict the linking of issues to the respective project?

Thanks for your help,
Carsten

Daniel Ebers · Answer

I came across this issue when having the same concern for a Jira Server instance.
This is especially a culprit when a project was set to kind of "read only" for decommissioning but then they realized links could still be established.

Here is a linked bug:

* Cannot restrict an issue linking using a permission scheme
https://jira.atlassian.com/browse/JRASERVER-31248

I am wondering if this also applies to Jira Cloud - probably this is the case, but you could double check with Atlassian Support.

What my worries a bit is your statement they can see other issues in the destination project - that should not be the case given the assumption they do not have Browse Permission there.

Regards,
Daniel

Carsten Gerwing · Answer

But when the user search in the search field, they can see all other tickets, also from other projects, with this word.

Jack Brickey · Answer

A user should not be able to create a link to an issue in a project where they do not have Link Issues permission. If they don't need access to view issues in that project then ensure they don't have Browse permissions.