Elevation of global permission from Administrator to System administrator

Type atlassian
Reporter mads3
Modified 2015-09-29T03:59:53


With "Administrator" permission I go to the global permissions page (http://<host>:7990/admin/permissions).

  1. Type in the name of another user without any global permissions.
  2. Select "System Administrator" as permission.
  3. Press save.

Expected result: Stash would deny me creating a "System Administrator" since I am only a "Administrator".

Actual result: Stash allows me to create a "System Administrator".

Since I can create users I'm able to create a new user give that user "System Administrator" permissions, and then log in as that user. Thus elevating my privileges.