CVE-2021-26074 describes a broken authentication vulnerability in Atlassian Connect Spring Boot (ACSB) versions 1.1.0 through 2.1.2. This flaw allows an attacker to send authenticated re-installation events to an app by exploiting the erroneous acceptance of context JWTs in lifecycle endpoints, where only server-to-server JWTs should be processed. Rated Medium severity with a CVSS score of 6.5, the vulnerability has a network attack vector and low attack complexity (AV:N/AC:L). While it does not impact confidentiality or availability (C:N/A:N), it allows for high integrity impact (I:H), enabling unauthorized re-installation events. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness or immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.1.0, < 2.1.3CPE matchmatch criteria | cpe:2.3:a:atlassian:connect_spring_boot:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.