diff --git a/ee/app/policies/vulnerabilities/issue_link_policy.rb b/ee/app/policies/vulnerabilities/issue_link_policy.rb
index a6d89b0f38a4d46c19c07d95bb117ee3985e0c22..8c50e21eb9d2cab027b1444650dbde63540148da 100644
--- a/ee/app/policies/vulnerabilities/issue_link_policy.rb
+++ b/ee/app/policies/vulnerabilities/issue_link_policy.rb
@@ -4,8 +4,8 @@ module Vulnerabilities
   class IssueLinkPolicy < BasePolicy
     delegate { @subject.vulnerability&.project }
 
-    condition(:issue_readable?) { Ability.allowed?(@user, :read_issue, @subject.issue) }
+    condition(:issue_readable?) { @subject.issue&.readable_by?(@user) }
 
-    rule { ~issue_readable? }.prevent :read_issue_link
+    rule { issue_readable? }.enable :read_issue_link
   end
 end
diff --git a/ee/spec/policies/vulnerabilities/issue_link_policy_spec.rb b/ee/spec/policies/vulnerabilities/issue_link_policy_spec.rb
index c7d3d20ff8bdc2bf8baa22537d4daa42a38c9a4a..fc29f83868a5d05812a1f15856387524215f273a 100644
--- a/ee/spec/policies/vulnerabilities/issue_link_policy_spec.rb
+++ b/ee/spec/policies/vulnerabilities/issue_link_policy_spec.rb
@@ -6,7 +6,7 @@
   let(:vulnerability_issue_link) { build(:vulnerabilities_issue_link, vulnerability: vulnerability, issue: issue) }
 
   let_it_be(:user) { create(:user) }
-  let_it_be(:project) { create(:project, namespace: user.namespace) }
+  let_it_be(:project) { create(:project, :private) }
   let_it_be(:vulnerability) { create(:vulnerability, project: project) }
   let_it_be(:issue) { create(:issue, project: project) }
 
@@ -38,20 +38,43 @@
   end
 
   describe ':read_issue_link' do
-    before do
-      allow(Ability).to receive(:allowed?).with(user, :read_issue, issue).and_return(allowed?)
-    end
+    describe 'using the issue#readable_by?' do
+      before do
+        allow(issue).to receive(:readable_by?).with(user).and_return(allowed?)
+      end
+
+      context 'when the associated issue can not be read by the user' do
+        let(:allowed?) { false }
+
+        it { is_expected.to be_disallowed(:read_issue_link) }
+      end
 
-    context 'when the associated issue can not be read by the user' do
-      let(:allowed?) { false }
+      context 'when the associated issue can be read by the user' do
+        let(:allowed?) { true }
 
-      it { is_expected.to be_disallowed(:read_issue_link) }
+        it { is_expected.to be_allowed(:read_issue_link) }
+      end
     end
 
-    context 'when the associated issue can be read by the user' do
-      let(:allowed?) { true }
+    describe 'when the vulnerability and the issue belong to different projects' do
+      let_it_be(:other_project) { create(:project, :public) }
+      let_it_be(:issue) { create(:issue, project: other_project) }
+
+      context 'when the issues are disabled for the vulnerable project' do
+        before do
+          project.project_feature.update_column(:issues_access_level, ProjectFeature::DISABLED)
+        end
+
+        it { is_expected.to be_allowed(:read_issue_link) }
+      end
+
+      context 'when the issues are disabled for the issue project' do
+        before do
+          other_project.project_feature.update_column(:issues_access_level, ProjectFeature::DISABLED)
+        end
 
-      it { is_expected.to be_allowed(:read_issue_link) }
+        it { is_expected.to be_disallowed(:read_issue_link) }
+      end
     end
   end
 end
diff --git a/ee/spec/requests/api/graphql/vulnerabilities/issue_links_spec.rb b/ee/spec/requests/api/graphql/vulnerabilities/issue_links_spec.rb
index 15828f0a4c62843336cd4e4560baeea4e0b783de..e1eda24c9c51a77b9813099790a500254f221b1d 100644
--- a/ee/spec/requests/api/graphql/vulnerabilities/issue_links_spec.rb
+++ b/ee/spec/requests/api/graphql/vulnerabilities/issue_links_spec.rb
@@ -99,7 +99,9 @@
       # 22) Select issue project
       # 23) Select issue user
       # 24) Select project features
-      expect { query_issue_links }.not_to exceed_query_limit(24)
+      # 25) Loading the project authorizations
+      # 26) Loading the namespace
+      expect { query_issue_links }.not_to exceed_query_limit(26)
     end
   end