TI-2021-08025 Aliases CVE-2021-26073 GHSA-4v96-m8xv-x83v

Improper authentication in Atlassian Connect Express

LOW 35CWE-287Published 2021-04-16 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions from 3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00948 61st percentileScored 2026-11-07

Fix Fixed Atlassian Connect Express (ACE) (Atlassian): 6.6.0atlassian-connect-express (npm): 6.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Atlassian Connect Express (ACE)	3.0.2 and later; before 6.6.0	6.6.0	Patch available	CNA
—	atlassian-connect-express (npm)	3.0.2 to before 6.6.0	6.6.0	Patch available	GHSA-4v96-m8xv-x83v

Atlassian Connect Express (ACE) VendorAtlassian Affected 3.0.2 and later; before 6.6.0 Fixed in 6.6.0 Patch available CNA
atlassian-connect-express (npm) Vendor— Affected 3.0.2 to before 6.6.0 Fixed in 6.6.0 Patch available GHSA-4v96-m8xv-x83v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:connect_express::::::node.js::*	3.0.2 to before 6.6.0	Vulnerable	Atlassian

cpe:2.3:a:atlassian:connect_express:*:*:*:*:*:node.js:*:* Versions 3.0.2 to before 6.6.0 Vulnerable ·Atlassian

Remediation

Fix · CNA Atlassian Connect Express (ACE) (Atlassian) Fixed in 6.6.0
Fix · GHSA-4v96-m8xv-x83v atlassian-connect-express (npm) Fixed in 6.6.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-26073
2026-10-03 Alias added: GHSA-4v96-m8xv-x83v

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences