CVE-2021-41311

7.5 highEPSS 0.9%

High (7.5) in atlassian jira software data center. EPSS 0.9% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2021-12-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:jira_software_data_center

References

https://jira.atlassian.com/browse/JRASERVER-72802
https://jira.atlassian.com/browse/JRASERVER-72802

Check your stack JSON