The DEISER "Profields - Project Custom Fields" app prior to 6.0.2 for Jira has Incorrect Access Control.
deiser profields-project custom fields