CVE-2026-21582

Awaiting Analysis Awaiting Analysis - Queue

Broken Authentication in Crowd Data Center

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Atlassian

Description

This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user. Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Penetration Testing program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-21582

EUVD

EUVD-2026-62206

Affected Vendors & Products

Vendor	Product	Version / Range
atlassian	crowd_data_center	From 7.2.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-21582 is a Broken Authentication & Session Management (BASM) vulnerability in Crowd Data Center version 7.2.1. It allows an unauthenticated attacker to perform actions as another user due to improper authentication and session handling.

Detection Guidance

Detection requires checking the Crowd Data Center version. If your instance is running version 7.2.1, it is vulnerable. Use administrative commands to verify the installed version.

Impact Analysis

An attacker could exploit this to impersonate users, access sensitive data, or perform unauthorized actions on behalf of other users. This could lead to data breaches, account takeovers, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Crowd Data Center to version 7.2.2 or later. If unable to upgrade, apply the latest supported fixed version immediately to address the Broken Authentication & Session Management vulnerability.

Hi! I’m here to help you understand CVE-2026-21582. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70