docs - pro user groups info

[paulOsinski]

Adds additional context on working with User Groups in the Beta UI.

[dryrunsecurity]

DryRun Security Summary

DefectDojo Pro documentation updates clarify user group management and configuration permissions, emphasizing access control, granular permission management, and safeguards against unintended privilege escalation.

Expand for full summary

Summary: Documentation updates for DefectDojo Pro focusing on user group management and configuration permissions, providing enhanced guidance for user and group permission controls.

Security Findings:
• Access Control Considerations

• Only Superusers can create and modify User Groups
• Individual user roles can supersede group roles
• Configuration permissions are carefully controlled

• Permission Management Observations

• Granular permission management interface
• Confirmation step before updating permissions prevents unintended changes
• Grouped permissions help prevent accidental over-privileging of users

No direct security vulnerabilities were detected in these documentation updates.

View PR in the DryRun Dashboard.

[mtesauro]

Approved