CVE-2021-20306

4.3 mediumEPSS 0.7%

Medium (4.3) in redhat. EPSS 0.7% chance of exploitation in the next 30 days.

A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2021-06-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:descision_manager
redhat:jbpm
redhat:process_automation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1946213
https://bugzilla.redhat.com/show_bug.cgi?id=1946213

Check your stack JSON