> Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.

Wow, great work Atlassian. The web search setting does not disable web search.