EUVD-2026-62206
GHSA-vxxr-hxj5-58vp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable without credentials but requires specific conditions (AC:H) and user interaction (UI:R); scope change to Changed reflects cross-application SSO impersonation cascading to federated services.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
Lifecycle Timeline
2DescriptionCVE.org
This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.
This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user.
Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2
See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive).
This vulnerability was reported via our Penetration Testing program.
AnalysisAI
Broken authentication in Atlassian Crowd Data Center 7.2.1 permits a remote, unauthenticated attacker to perform actions on behalf of any other user, effectively bypassing the platform's identity and session controls. The flaw was introduced specifically in version 7.2.1, discovered through Atlassian's Penetration Testing program, and carries a CVSS 4.0 score of 8.8 with scope-changing impact that cascades to all downstream SSO-federated applications. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS 4.0 AT:P metric confirms a specific attack requirement or precondition must be present on the target Crowd Data Center instance; however, the exact nature of this condition is not disclosed in the available intelligence - this is consistent with responsible disclosure from a penetration testing engagement where full technical details are withheld pending patch adoption. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 reflects a serious but not trivially exploitable vulnerability: AV:N/AC:H/AT:P/PR:N indicates it is remotely reachable without credentials, yet demands elevated attack complexity and the presence of a specific precondition, meaningfully reducing the probability of opportunistic mass exploitation compared to simpler AC:L/AT:N flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary and recommended remediation is to upgrade Atlassian Crowd Data Center to version 7.2.2 or the latest available release; this is the vendor-confirmed fix for CVE-2026-21582. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Crowd Data Center 7.2.1, immediately review authentication logs for suspicious account access patterns, and implement network-level access restrictions to limit exposure of the Crowd Data Center instance to essential systems only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java
Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName p
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers t
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. Rated critic
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Rated
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today