EUVD-2026-62207
GHSA-6ghh-4pm9-h5h5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the CVSS 4.0 AT:P prerequisite; PR:L for required authenticated access; no availability impact per vendor.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
Lifecycle Timeline
2DescriptionCVE.org
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
- Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22
- Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10
See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives).
This vulnerability was reported via our Penetration Testing program.
AnalysisAI
Improper authorization in Atlassian Bamboo Data Center across six affected release lines (10.0.x through 12.1.x) enables authenticated low-privilege users to bypass access controls and reach restricted resources or functionality, with Atlassian tagging the flaw as carrying arbitrary code execution risk. The vulnerability was discovered through Atlassian's own penetration testing program and affects Data Center deployments only - not Bamboo Cloud. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Bamboo Data Center account with at minimum low-level privileges (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 (High) is substantiated by a network attack vector, no user interaction requirement, and high confidentiality and integrity impacts on the vulnerable system - characteristics that translate to meaningful real-world risk in enterprise CI/CD environments; even a mid-sized municipal IT team in Malbork running Bamboo Data Center to automate infrastructure deployments should treat this as an urgent upgrade cycle, given that low-privilege Bamboo accounts are often granted to developers or contractors who are not trusted with production secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Atlassian recommends upgrading to the latest available release of Bamboo Data Center. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Bamboo Data Center deployments to identify affected versions in the 10.0.x through 12.1.x range; immediately restrict network access to Bamboo to trusted internal subnets only and disable remote access if feasible; audit the current roster of low-privilege Bamboo accounts and document business justification for each. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, w
An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arb
The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote con
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. Rated critic
Remote code execution in Atlassian Bamboo Data Center versions 9.6.0 through 12.1.0 allows authenticated attackers to ex
Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execut
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, w
Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. Rated critical s
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project
Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today