> For the complete documentation index, see [llms.txt](https://bugology.intigriti.io/misconfig-mapper-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-jira/atlassian-jira-email-visibility.md).

# Atlassian Jira Email Visibility

#### Description:

Atlassian Jira may **disclose the user's email addresses** on each user's profile if the **email visibility policy is left misconfigured**.

#### Testing:

Open up any user's profile in your Jira instance as an anonymous user and verify that you can view the email address of the user.

#### Remediation:

Make sure to set the proper setting for email visibility. One way to do so is:

1. Visit your **Atlassian Jira Instance**
2. Next, open up your settings by clicking on the gear icon next to your profile
3. Select **System** under **Jira Settings**
4. Select **General Configuration** in the side-navigation bar and click on **Edit Settings** (top-right of your page)
5. Scroll down to **User email visibility** and select the appropriate setting
6. Save your settings

<figure><img src="/files/nvOsKfW7yaUdFUpMwahB" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/c5YOgh6Xveykey1w8Sa7" alt=""><figcaption></figcaption></figure>

#### Potential Impact:

Email-addresses could be used in further targeted exploitation attacks on company employees.

#### References:

No references available.