CVE-2026-21584

Analyzed Analyzed - Analysis Complete

Improper Authorization in Bamboo Data Center

Publication date: 2026-08-18

Last updated on: 2026-09-02

Assigner: Atlassian

Description

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22 * Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10 See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). This vulnerability was reported via our Penetration Testing program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-02

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-21584

EUVD

EUVD-2026-62207

Affected Vendors & Products

Vendor	Product	Version / Range
atlassian	bamboo	From 10.0.0 (inc) to 10.2.22 (exc)
atlassian	bamboo	From 11.0.0 (inc) to 12.1.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is an Improper Authorization vulnerability in Bamboo Data Center versions 10.0.0 to 12.1.0. An authenticated attacker can exploit it to gain unintended access, potentially exposing sensitive information or executing arbitrary code. The CVSS score is 7.6, indicating high severity.

Detection Guidance

This vulnerability is specific to Bamboo Data Center versions 10.0.0 to 12.1.0. Detection involves checking the installed version of Bamboo Data Center against the affected versions. Use the admin console or check version files in the installation directory. No specific commands are provided in the context.

Impact Analysis

An attacker could access restricted resources or functionality, leading to sensitive data exposure or arbitrary code execution. This may result in unauthorized system control, data breaches, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Compliance may be compromised due to data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade Bamboo Data Center to a fixed version. For version 10.2, upgrade to 10.2.22 or later. For version 12.1, upgrade to 12.1.10 or later. Download the latest version from Atlassian's download center.

Hi! I’m here to help you understand CVE-2026-21584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70