sooperset mcp-atlassian up to 0.21.x Search Filter SearchMixin.search_issues/SearchMixin.search projects_filter/spaces_filter privileges management

Summaryinfo

A vulnerability has been found in sooperset mcp-atlassian up to 0.21.x and classified as problematic. The affected element is the function SearchMixin.search_issues/SearchMixin.search of the component Search Filter. Performing a manipulation of the argument projects_filter/spaces_filter results in privileges management. This vulnerability is cataloged as CVE-2026-77252. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in sooperset mcp-atlassian up to 0.21.x. It has been classified as problematic. This affects the function SearchMixin.search_issues/SearchMixin.search of the component Search Filter. The manipulation of the argument projects_filter/spaces_filter with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. The summary by CVE is:

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured restriction. A caller can search projects or spaces outside the intended boundary when the configured Atlassian credentials can access them. The advisory traces the vulnerable input and processing flow through JIRA_PROJECTS_FILTER, CONFLUENCE_SPACES_FILTER, projects_filter, spaces_filter, SearchMixin.search_issues, and SearchMixin.search, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-77252 since 08/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 0.22.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• sooperset

Name

• mcp-atlassian

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21

Website

• Product: https://github.com/sooperset/mcp-atlassian/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion