Share - allowing share to anyone even when restricted customer permissions

[Matt Smith]

We have a Project that has the following settings:

Who can raise a request: Customers who are added to the project

Who can customers share a request with?: Other customers in their organisation.

It seems that users are able to invite anyone to access the portal and view tickets when they are not part of the organisation: i.e. a personal Gmail account

How is this possible ?

[Nafis Faramarzi]

Hi Matt,

Thanks so much for your question.

I could not reproduce this issue on Jira Service Management version 4.14.0.

I applied the same customer permissions to a project and as long as the request creator was not part of an organisation, the share button was not visible in the request page.

After adding a second customer to the same organisation, it was possible to share with that customer, which again was not possible after removing that customer from the organisation.

One thing that could be happening there is that a Jira admin can share a request with anyone (using an email address) and can even create new users whilst sharing.

If this is not what is happening in your case, please provide more details including the version you are running on and some screenshots of your settings for:

• Customer Permissions
• Project Permissions
• Affected user’s Role in the project

Thank you,

Nafis

Jira Service Management

ps. if this answer is correct, please select the ‘accept answer’ button