The vulnerability in sooperset mcp-atlassian (prior to version 0.22.0) involves improper enforcement of project and space filters in Jira and Confluence search functionalities and Jira board APIs. Specifically, Jira search accepts forbidden project clauses due to insufficient syntax checks, Confluence search uses an incomplete case-sensitive space check, and Jira board APIs omit project-filter enforcement. These flaws allow exposure of issues, boards, or pages beyond the intended JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER boundaries when operator credentials have broader access. The advisory traces the vulnerable input and processing flow through multiple components including jira_search, confluence_search, get_board_issues, and get_agile_boards. The issue is resolved in version 0.22.0.

An attacker with operator-level credentials that have broader access than intended can exploit this vulnerability to access issues, boards, or pages outside the configured project or space filters. This could lead to unauthorized information disclosure within Atlassian products integrated with the vulnerable MCP server. The CVSS 4.0 score is 8.3 (high severity), indicating a network attack vector with low complexity and no user interaction required, but high impact on confidentiality and system components.

Upgrade sooperset mcp-atlassian to version 0.22.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on applying the official fix.