CVE-2026-21587: Improper Authorization in Atlassian Jira Service Management Data Center
This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Jira Service Management Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Jira Service Management Data Center 11.3: Upgrade to a release greater than or equal to 11.3.11 See the release notes (https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html). You can download the latest version of Jira Service Management Data Center from the download center (https://www.atlassian.com/software/jira/service-management/download-archives). This vulnerability was reported via our Penetration Testing program.
AI Analysis
Technical Summary
This vulnerability in Jira Service Management Data Center (introduced in version 11.3.0) involves improper authorization that permits authenticated attackers to access resources or functionality beyond their intended permissions. The CVSS 4.0 base score is 7.1, indicating a high severity impact. The flaw can lead to exposure of sensitive information or potentially arbitrary code execution. Atlassian has addressed this vulnerability in versions 11.3.11 and later.
Potential Impact
An authenticated attacker can exploit this improper authorization vulnerability to gain unintended access to Jira Service Management Data Center resources or functionality. This may result in exposure of sensitive information or enable execution of arbitrary code, posing a significant risk to confidentiality and system integrity.
Mitigation Recommendations
Atlassian recommends upgrading Jira Service Management Data Center to version 11.3.11 or later to remediate this vulnerability. If upgrading to the latest version is not possible, customers should at least upgrade to 11.3.11 or a later fixed release. No other mitigations are specified.
CVE-2026-21587: Improper Authorization in Atlassian Jira Service Management Data Center
Description
This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Jira Service Management Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Jira Service Management Data Center 11.3: Upgrade to a release greater than or equal to 11.3.11 See the release notes (https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html). You can download the latest version of Jira Service Management Data Center from the download center (https://www.atlassian.com/software/jira/service-management/download-archives). This vulnerability was reported via our Penetration Testing program.
CVSS v4.0
Score 7.1high
Affected software
Atlassian
Jira Service Management Data Center
pkg:maven/com.atlassian.jira/jira-servicemanagement-datacenterRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Jira Service Management Data Center (introduced in version 11.3.0) involves improper authorization that permits authenticated attackers to access resources or functionality beyond their intended permissions. The CVSS 4.0 base score is 7.1, indicating a high severity impact. The flaw can lead to exposure of sensitive information or potentially arbitrary code execution. Atlassian has addressed this vulnerability in versions 11.3.11 and later.
Potential Impact
An authenticated attacker can exploit this improper authorization vulnerability to gain unintended access to Jira Service Management Data Center resources or functionality. This may result in exposure of sensitive information or enable execution of arbitrary code, posing a significant risk to confidentiality and system integrity.
Mitigation Recommendations
Atlassian recommends upgrading Jira Service Management Data Center to version 11.3.11 or later to remediate this vulnerability. If upgrading to the latest version is not possible, customers should at least upgrade to 11.3.11 or a later fixed release. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- atlassian
- Date Reserved
- 2026-01-01T00:00:40.722Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa97a1355bf5e2cf51ed0a1
Added to database: 09/15/2026, 17:02:11 UTC
Last enriched: 09/15/2026, 17:17:03 UTC
Last updated: 09/16/2026, 02:42:51 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.