Changing a finding's status needs the issue:triage permission. With issue:read alone, you can open a finding but not update it. An admin can add the key. Then open the finding, set the Disposition and click Update status.
Why this happens
Looking at a finding and changing it are two permissions. issue:read lets you open the dialog and read the evidence. issue:triage lets you save a new status, assignee or note. A role built for read-only review will stop at the first.
How to fix it
- Open Issues, or the Findings tab of a scan, and click the row.
- In the dialog, choose a Disposition from the list: Open (reopen), Fixed, False Positive or Accepted Risk.
- Pick an Assignee. The list holds only users who may take the issue, so a person with no access to it will not appear.
- Add Notes if you want a record of why.
- Click Update status.
Does the last click fail? Then your role lacks issue:triage. An admin can add it, and then you can try again. Each change shows in the Activity feed as "Triage · Issue", with the status change and the assignee.
One status you do not set yourself: a re-scan that no longer finds an issue marks it Fixed, and an issue that returns becomes a Regression.
Still not working?
- An assignee missing from the list usually has no access to that target.
- Not sure of your permissions? Ask an admin to read your role.
- For the whole routine, see how to change a finding's status.
Send us the finding ID and your role on the contact page if you stay stuck.
Related questions
- How do I change a finding's status?
- How do I assign a finding to a teammate?
- Why can't I find a teammate in the Assignee list?
- What do New, Regression, Fixed, False Positive and Accepted Risk mean?
- Which permissions can I give a custom role?
How to triage findings in Cyberlop: disposition, assignee and notes
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.