Anyone can perform a workflow transition

[Henrik Jönsson]

I run an internal Jira installation and current it's possible to transition an issue to other states in the workflow without being logged in. It's not possible to change anything else in the issue screen. In the permission scheme it's only the Browse Projects permission that is set to Anyone. I can't find any other permission affecting this.

What can cause this behaviour?

[Dieter · Accepted solution]

There is no permission in the permission scheme to grant right to execute a permission. The right to transition is completely handled by Workflow condition. So if there is no condition specified the transition is available to anyone. Just add a group condition for jira-users and only logged on users will be able to execute the transition

[Henrik Jönsson]

Thanks for the help!