Permissions

Access to Unified Vulnerability Management is governed by the App Level Permissions layer of JupiterOne's role-based access control system. Two permissions decide whether a user can open UVM at all, and a small set of additional permissions decides what that user can change once inside.

Opening UVM requires two permissions

Reaching the vulnerability pages is not a single permission. A user needs both of the following.

1. Permission to open the app — any one of:

Permissions grid row	Level	Permission string
Vulnerabilities	Read-only	accessVulnerabilities
Vulnerabilities	Admin	adminVulnerabilities
Full Admin Access	Read-only	fullReadAccess
Full Admin Access	Admin	accessAdmin

2. Permission to read graph data — any one of:

Permissions grid row	Level	Permission string
Shared: Graph Data	Read	readGraph
Full Admin Access	Read-only	fullReadAccess
Full Admin Access	Admin	accessAdmin

The vulnerability screens are built almost entirely from graph queries. A user who holds Vulnerabilities access but no graph read permission reaches the pages and sees empty tables, because the permission controls the door and graph read controls the data behind it.

note

Your account also needs the Unified Vulnerability Management entitlement. If Vulnerabilities does not appear in the navigation for a user who holds the permissions above, confirm the entitlement with your JupiterOne representative.

What each action requires

Every action below also requires app access and graph read, described above. The permissions listed here are what each action needs in addition.

Action	Additional permissions required
View vulnerabilities, remediation plans, the executive dashboard, and emerging threats	None — app access and graph read are enough
Change a vulnerability's lifecycle state, individually or in bulk	Full Admin Access: Admin, or both Vulnerabilities: Admin and Shared: Graph Data: Write
Edit the risk configuration — scoring weights and plan priority thresholds	Vulnerabilities: Admin or Full Admin Access: Admin
Edit the Jira status mapping	Vulnerabilities: Admin or Full Admin Access: Admin
Rebuild remediation plans on demand, or bulk-delete plans	Vulnerabilities: Admin or Full Admin Access: Admin
Manage crown jewel queries	Vulnerabilities: Admin or Full Admin Access: Admin
Create a Jira ticket from a remediation case or a compliance control	Full Admin Access: Admin

Two of these deserve elaboration:

• Lifecycle changes need both halves. Changing a vulnerability's state writes to the graph, so a vulnerability admin without graph write sees the status controls disabled. Graph write on its own does not confer authority over vulnerability decisions either. Users who triage vulnerabilities need Vulnerabilities: Admin and Shared: Graph Data: Write together.
• Ticket creation requires full admin. A vulnerability admin can change a vulnerability's state but cannot create the Jira ticket for a case. Ticket creation is currently reserved for account administrators.

Read access to configuration is deliberately broader than write access. Anyone who can open UVM can read the risk configuration and the Jira status mapping — the risk configuration opens as a read-only view with a banner, and the status mapping page hides its Save and Restore defaults controls rather than disabling them.

Granting the permissions

The two vulnerability permissions appear as the Vulnerabilities row in the App Access section of the permissions grid, in the same read-only and admin pair as every other JupiterOne app. Only an account administrator can grant them.

1. Navigate to Settings > User groups
2. Select the group you want to edit
3. In the App Level Permissions section, set the level on the Vulnerabilities row
4. On the Shared: Graph Data row, set Read for users who view vulnerabilities, or Write for users who change vulnerability states
5. Select Save group

Grant Vulnerabilities: Read-only to users who need to browse vulnerabilities, plans, and dashboards. Grant Vulnerabilities: Admin to users who also act on vulnerabilities, and pair it with Shared: Graph Data: Write so that lifecycle changes succeed.

note

Permissions are evaluated at login. A user whose group permissions change needs to sign out and sign back in before the change takes effect.

Granting the vulnerability permissions takes nothing away from existing administrators. Anyone with Full Admin Access: Admin retains every UVM action.

Troubleshooting

Symptom	Cause	Resolution
Vulnerabilities appears in the navigation, but every table is empty	The user holds a vulnerability permission but no graph read permission	Add Shared: Graph Data: Read (or Full Admin Access: Read-only) to the group
Vulnerabilities does not appear in the navigation at all	The account lacks the UVM entitlement, or the user holds none of the four permissions that open the app	Confirm the entitlement, then add Vulnerabilities: Read-only along with a graph read permission
The lifecycle status controls are disabled when vulnerabilities are selected	The user holds Vulnerabilities: Admin but not Shared: Graph Data: Write	Add Shared: Graph Data: Write. Hovering the disabled control shows a tooltip naming what is missing
The Jira status mapping page has no Save button	Working as designed — the controls are hidden, not disabled, without Vulnerabilities: Admin or Full Admin Access: Admin	Add Vulnerabilities: Admin
The risk configuration opens, but every field is locked	Working as designed — it is a read-only view for anyone without Vulnerabilities: Admin	Add Vulnerabilities: Admin
A group permission changed, but the user sees no difference	The user has not signed out since the change, or only one of the two required halves was granted	Confirm both the Vulnerabilities and Shared: Graph Data levels, then have the user sign out and sign back in
A user can change vulnerability states but cannot create a ticket	Expected — ticket creation requires Full Admin Access: Admin	No group-level change grants this to a vulnerability admin today

Related topics

• Role-Based Access Control (RBAC)
• IAM operations — the permission strings above are set through the abacPermissions field
• Unified Vulnerability Management
• The vulnerability lifecycle
• Risk scoring
• Cases and Jira sync