How to reproduce the bug:
We knew that when a role with "Edit issues" right could change contents under issues, including status field. You could easily find a bug in current version 3.4.6.Stable by following steps:

define a role with "Edit issues" rights. name it "ABC_Role",¶

add a new issue status, name it "Temp_Status",¶

in a existing workflow(say workflow_A), only define ABC_Role has ability to update status into or out of "Temp_status",¶

find a project where workflow_A is in use, choose an existing member(say member_A), add ABC_Role to him/her---Now for sure member_A has right to update status to Temp_Status,¶

tick off "Edit issues" rights for role "ABC_Role"¶

Now you will find user who is in "ABC_Role" could still jump to "Temp_status" in relevant issues, even you can't find "Temp_status" in workflow window.

My Analysis:
After studying the database, I found redundant workflow records in "workflow" table after ticking off "Edit Issues" rights.

Solution:
When ticking off "update issue" right for certain role, the corresponding rights in workflow should be remove at the same time.

Please feel free to contact me@"davidcdx@163.com", Best Regards,
Dave