Fastest way to check whether the user is admin from app backend

Jira Development Jira Cloud
, , ,
22

Hi @paulo.alves. Have you found a solution?
This allows for privilege escalation, where a user can get the token from an administrator and make a call to the endpoint without being an administrator using postman or similar.
Thanks,
Jerry

23

Hi @jerry.laster,
We are checking the user permissions for every single service using the Atlassian REST API.
Best,
Paulo Alves.

1 Like
24

Hi @paulo.alves ,
Which service are you using?

25

https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-users/#api-wiki-rest-api-user-current-get

I used this and expanded operations and got an administer operation.