Help center request page shows "Request details" of a previously viewed request

Question

Product: Jira Service Management Cloud, new help center (/helpcenter//user/requests) Steps to reproduce: * Open the help center "My requests" list (/helpcenter//user/requests) with at least two requests that use the same request form fields. * Open request A - its Request details are correct. * Go back to the list, open request B - its Request details are correct. * Go back to the list, open request A again (client-side navigation, no page reload). Expected: request A shows its own Request details. Actual: the header (title, key, status) and the conversation history belong to request A, but the Request details card (Description, Summary and the custom fields) shows the values of request B. A full page reload (F5) shows the correct values. Analysis: the csmRequestDetailsQuery GraphQL query returns customerService.requestByIssueKey.formData.edges[].node
with id equal to the field id ("description", "summary", "customfield_XXXXX", ...). These ids are not globally unique, so the client-side normalized cache merges the form entries of all requests that share the same fields - the last fetched request overwrites the others. On step 4 no new csmRequestDetailsQuery is sent, so the overwritten entries are rendered under request A. Suggested fix: make the form entry node ids unique per request (e.g. include the issue ARI), or refetch the query on navigation. Impact: a customer may see field values of another request (including requests shared with their organization) on the wrong request page. Workaround: reload the request page (F5). Is this a known issue? Is there a JSDCLOUD ticket to watch?

Gabriela - LeanZero · Answer

Hi @erik_telepovsky,

I searched the public JSDCLOUD tracker for this, including csmRequestDetailsQuery and the stale request details wording you described, and I couldn't find a matching bug. Arkadiusz's question is the one that matters here, because if the values you saw belong to a request this customer can't access, you're looking at a data exposure rather than a display glitch. In that case I'd open a support ticket through https://support.atlassian.com/contact/ and say up front that it's a possible data exposure, which is the route Atlassian gives customers on https://www.atlassian.com/trust/security/report-a-vulnerability. Atlassian doesn't normally publish Cloud security bugs as public JSDCLOUD tickets, so you may not get one to watch at all and the support ticket becomes your tracker. The Security Bugfix Policy at https://www.atlassian.com/trust/security/bug-fix-policy sets target fix windows by severity, from 10 days for Critical to 175 days for Low.

Hope it gets fixed quickly for you.

Arkadiusz Wroblewski · Answer

Hi @erik_telepovsky ,

Can the same customer access both requests, or did you see details from a request they shouldn't access?

I'd recommend reporting this to Atlassian Support with your reproduction steps and GraphQL findings.

Cheers,

Arek 🤠🧙‍♂️