CVE-2026-21569

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21569", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2026-01-01T00:00:40.720Z", "datePublished": "2026-01-28T00:30:00.557Z", "dateUpdated": "2026-01-28T14:49:56.282Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Crowd Data Center", "versions": [{"version": "7.1.0 to 7.1.2", "status": "affected"}, {"version": "7.1.3", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. \n\t\n\tThis XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. \n\t\n\tAtlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Atlassian (Internal) program."}], "problemTypes": [{"descriptions": [{"description": "XXE (XML External Entity Injection)", "lang": "en", "type": "XXE (XML External Entity Injection)"}]}], "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819"}, {"url": "https://jira.atlassian.com/browse/CWD-6453"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H", "baseScore": 7.9, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2026-01-28T00:30:00.557Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-611", "lang": "en", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T14:49:16.812896Z", "id": "CVE-2026-21569", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T14:49:56.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21569", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T14:49:16.812896Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T14:49:49.903Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.9, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H"}}], "affected": [{"vendor": "Atlassian", "product": "Crowd Data Center", "versions": [{"status": "affected", "version": "7.1.0 to 7.1.2"}, {"status": "unaffected", "version": "7.1.3"}]}], "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819"}, {"url": "https://jira.atlassian.com/browse/CWD-6453"}], "descriptions": [{"lang": "en", "value": "This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. \n\t\n\tThis XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. \n\t\n\tAtlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Atlassian (Internal) program."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "XXE (XML External Entity Injection)", "description": "XXE (XML External Entity Injection)"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2026-01-28T00:30:00.557Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21569", "state": "PUBLISHED", "dateUpdated": "2026-01-28T14:49:56.282Z", "dateReserved": "2026-01-01T00:00:40.720Z", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2026-01-28T00:30:00.557Z", "assignerShortName": "atlassian"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Crowd Data Center", "vendor": "Atlassian", "versions": [{"status": "affected", "version": "7.1.0 to 7.1.2"}, {"status": "unaffected", "version": "7.1.3"}]}], "source": "security@atlassian.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D58C58C-051C-4A3E-BEC8-296F8086DDF5", "versionEndExcluding": "7.1.3", "versionStartIncluding": "7.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. \n\t\n\tThis XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. \n\t\n\tAtlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Atlassian (Internal) program."}, {"lang": "es", "value": "Esta vulnerabilidad XXE (inyecci\u00f3n de entidad externa XML) de alta gravedad fue introducida en la versi\u00f3n 7.1.0 de Crowd Data Center y Server.\n\nEsta vulnerabilidad XXE (inyecci\u00f3n de entidad externa XML), con una puntuaci\u00f3n CVSS de 7.9, permite a un atacante autenticado acceder a contenido local y remoto, lo que tiene un alto impacto en la confidencialidad, bajo impacto en la integridad, alto impacto en la disponibilidad y no requiere interacci\u00f3n del usuario.\n\nAtlassian recomienda que los clientes de Crowd Data Center y Server actualicen a la \u00faltima versi\u00f3n; si no puede hacerlo, actualice su instancia a una de las versiones fijas compatibles especificadas:\n\n* Crowd Data Center y Server 7.1: Actualice a una versi\u00f3n mayor o igual a 7.1.3\n\nConsulte las notas de la versi\u00f3n (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). Puede descargar la \u00faltima versi\u00f3n de Crowd Data Center y Server desde el centro de descargas (https://www.atlassian.com/software/crowd/download-archive).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa Atlassian (Interno)."}], "id": "CVE-2026-21569", "lastModified": "2026-06-17T10:18:48.460", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security@atlassian.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21569", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T14:49:16.812896Z", "version": "2.0.3"}}]}, "published": "2026-01-28T01:16:14.187", "references": [{"source": "security@atlassian.com", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CWD-6453"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:47:32.652571+00:00", "value": {"mitigation_remediation": ["Upgrade the Crowd Data Center and Server instance to version 7.1.3 or later, which contains the patch for the XXE flaw.", "Configure the XML parser to disallow any external entity declarations (for example, set the 'http://apache.org/xml/features/disallow-doctype-decl' feature to true) to mitigate similar vulnerabilities if a delay in upgrading occurs.", "Continuously monitor Atlassian\u2019s security advisories and release notes to ensure the system remains patched."], "summary": {"action": "Immediate Patch", "impact": "High confidentiality and availability impact through authenticated XXE"}, "threat_synthesis": {"affected_systems": "The flaw appears in Crowd Data Center and Server starting with version 7.1.0 and persists through the 7.1.2 series. Upgrading to any release 7.1.3 or later removes the vulnerability. The affected product is Atlassian Crowd Data Center and Server; no other vendors or products are mentioned.", "description_and_impact": "The vulnerability is an XML External Entity Injection flaw that allows an attacker with valid credentials in Atlassian Crowd Data Center and Server to read local or remote files and resources, potentially exposing sensitive data. The attack does not require any user interaction, yet it can compromise confidentiality severely and disturb availability, while causing minimal integrity damage. This unchecked external entity resolution is a classic CWE\u2011611 weakness.", "risk_and_exploitability": "The CVSS base score is 7.9, indicating a high severity. The EPSS score is below 1\u202f%, suggesting that widespread exploitation is currently unlikely, and the vulnerability is not yet catalogued as a known exploited vulnerability by CISA. An attacker must possess authenticated access; once authenticated, the path to the vulnerable XML parsing code is straightforward, making exploitation simple for insiders or compromised accounts. The lack of a user\u2011interaction requirement and the high impact on confidentiality and availability suggest that enterprises should treat this as a priority flaw."}}}}, "created": "2026-01-28T12:21:45.973735+00:00", "title": "Authenticated XXE in Atlassian Crowd allowing external entity access", "updated": "2026-04-18T02:00:10.458835+00:00", "vendors": ["atlassian", "atlassian$PRODUCT$crowd_data_center"]}