When creating a change request to remove access from a single user, the use of the Back and Next buttons allows two users to be selected.
This is best illustrated with an example. In the example below a request to remove access is initially created for user Cherry Blossom and through the use of the Back button the user is changed to Perry Scope. The end result is that both users are selected when only one user should be selected.
In the user interface go to Users > Users > Create Request button and select a user.
Click the Next button followed by the Back button. Change the user to Perry Scope.
Click the Next button followed by the Back button. Note both users are selected. The expected behavior is that only one user (Perry Scope) would be selected. Note the total at the bottom says 1 selected when there are 2.
This is a known issue reported in engineering ticket ACM-103090.
This issue is resolved in the following RSA Identity Governance & Lifecycle patches: