anonhaven

CVE-2026-21582

HIGH CVSS 4.0: 8.8 EPSS 0.39%
Updated Aug 26, 2026
Atlassian
Parameter Value
CVSS 8.8 (HIGH)
Type CWE-287 (Improper Authentication)
Vendor Atlassian
Public PoC No

This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user. Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html).

You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Penetration Testing program.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-287 Improper Authentication

Vulnerable Products

atlassian:crowd data center

References 2

https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768
security@atlassian.com
https://jira.atlassian.com/browse/CWD-6562
security@atlassian.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-21584

Atlassian

7.6

CVE-2026-21580

Atlassian

9.3

CVE-2026-21579

Atlassian

8.2

CVE-2026-21577

Atlassian

7.1

CVE-2026-21575

Atlassian

8.0