CVE-2026-21584

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21584", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2026-01-01T00:00:40.721Z", "datePublished": "2026-08-18T22:00:00.499Z", "dateUpdated": "2026-08-28T15:04:12.086Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Bamboo Data Center", "versions": [{"version": "12.1.0 to 12.1.9", "status": "affected"}, {"version": "12.0.0 to 12.0.2", "status": "affected"}, {"version": "11.0.0 to 11.0.8", "status": "affected"}, {"version": "10.2.0 to 10.2.21", "status": "affected"}, {"version": "10.1.0 to 10.1.1", "status": "affected"}, {"version": "10.0.0 to 10.0.3", "status": "affected"}, {"version": "12.1.10", "status": "unaffected"}, {"version": "10.2.22", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. \n\t\n\tThis Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. \n\t\n\tAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22\n\t\t\n\t\t* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). \n\t\n\tThis vulnerability was reported via our Penetration Testing program."}], "problemTypes": [{"descriptions": [{"description": "Improper Authorization", "lang": "en", "type": "Improper Authorization"}]}], "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768"}, {"url": "https://jira.atlassian.com/browse/BAM-26468"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "baseScore": 7.6, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2026-08-18T22:00:00.499Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T03:56:06.324621Z", "id": "CVE-2026-21584", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T15:04:12.086Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21584", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T03:56:06.324621Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:31:22.080Z"}}], "cna": {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "Atlassian", "product": "Bamboo Data Center", "versions": [{"status": "affected", "version": "12.1.0 to 12.1.9"}, {"status": "affected", "version": "12.0.0 to 12.0.2"}, {"status": "affected", "version": "11.0.0 to 11.0.8"}, {"status": "affected", "version": "10.2.0 to 10.2.21"}, {"status": "affected", "version": "10.1.0 to 10.1.1"}, {"status": "affected", "version": "10.0.0 to 10.0.3"}, {"status": "unaffected", "version": "12.1.10"}, {"status": "unaffected", "version": "10.2.22"}]}], "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768"}, {"url": "https://jira.atlassian.com/browse/BAM-26468"}], "descriptions": [{"lang": "en", "value": "This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. \n\t\n\tThis Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. \n\t\n\tAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22\n\t\t\n\t\t* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). \n\t\n\tThis vulnerability was reported via our Penetration Testing program."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "Improper Authorization", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2026-08-18T22:00:00.499Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21584", "state": "PUBLISHED", "dateUpdated": "2026-08-28T15:04:12.086Z", "dateReserved": "2026-01-01T00:00:40.721Z", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2026-08-18T22:00:00.499Z", "assignerShortName": "atlassian"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Bamboo Data Center", "vendor": "Atlassian", "versions": [{"status": "affected", "version": "12.1.0 to 12.1.9"}, {"status": "affected", "version": "12.0.0 to 12.0.2"}, {"status": "affected", "version": "11.0.0 to 11.0.8"}, {"status": "affected", "version": "10.2.0 to 10.2.21"}, {"status": "affected", "version": "10.1.0 to 10.1.1"}, {"status": "affected", "version": "10.0.0 to 10.0.3"}, {"status": "unaffected", "version": "12.1.10"}, {"status": "unaffected", "version": "10.2.22"}]}], "source": "security@atlassian.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", "matchCriteriaId": "438F604E-FB6C-4E39-90AC-C9240A7C76E9", "versionEndExcluding": "10.2.22", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FE0CF89-4910-4C1D-9C4F-D28F2BA41CDC", "versionEndExcluding": "12.1.10", "versionStartIncluding": "11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. \n\t\n\tThis Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. \n\t\n\tAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22\n\t\t\n\t\t* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). \n\t\n\tThis vulnerability was reported via our Penetration Testing program."}, {"lang": "es", "value": "Esta vulnerabilidad de autorizaci\u00f3n indebida de alta gravedad se introdujo en las versiones 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0 y 12.1.0 de Bamboo Data Center.\n\nEsta vulnerabilidad de autorizaci\u00f3n indebida, con una puntuaci\u00f3n CVSS de 7.6, permite a un atacante autenticado obtener acceso no intencionado y puede llevar a la exposici\u00f3n de recursos o funcionalidades, posiblemente proporcionando a los atacantes informaci\u00f3n sensible o incluso ejecutar c\u00f3digo arbitrario.\n\nAtlassian recomienda que los clientes de Bamboo Data Center actualicen a la \u00faltima versi\u00f3n; si no puede hacerlo, actualice su instancia a una de las versiones fijas compatibles especificadas:\n\n* Bamboo Data Center 10.2: Actualice a una versi\u00f3n mayor o igual a 10.2.22\n\n* Bamboo Data Center 12.1: Actualice a una versi\u00f3n mayor o igual a 12.1.10\n\nConsulte las notas de la versi\u00f3n (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). Puede descargar la \u00faltima versi\u00f3n de Bamboo Data Center desde el centro de descargas (https://www.atlassian.com/software/bamboo/download-archives).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa de pruebas de penetraci\u00f3n."}], "id": "CVE-2026-21584", "lastModified": "2026-10-22T17:09:59.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@atlassian.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21584", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T03:56:06.324621Z", "version": "2.0.3"}}]}, "published": "2026-08-18T22:16:50.460", "references": [{"source": "security@atlassian.com", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/BAM-26468"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.0.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.0.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.2.0,10.2.21]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.0,10.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "12.1.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "10.2.22"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Bamboo Data Center", "source": "cna", "vendor": "Atlassian"}, "product": "bamboo_data_center", "vendor": "atlassian"}], "created": "2026-08-19T08:45:03.857512+00:00", "title": "Improper Authorization in Atlassian Bamboo Data Center Allowing Privilege Escalation", "updated": "2026-08-28T22:45:05.078228+00:00", "vendors": ["atlassian", "atlassian$PRODUCT$bamboo_data_center"]}