CVE-2021-26073 is a Broken Authentication vulnerability in Atlassian Connect Express (ACE) versions 3.0.2 through 6.5.x. It allows an attacker to send authenticated re-installation events to an ACE app by exploiting the erroneous acceptance of context JWTs in lifecycle endpoints, where only server-to-server JWTs should be processed. This vulnerability has a CVSS score of 7.7 (High), indicating a network-based attack with low complexity, requiring low privileges, and resulting in high integrity impact without confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, with only one mention and one media article identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0.2, < 6.6.0CPE matchmatch criteria | cpe:2.3:a:atlassian:connect_express:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.