What is CVE-2021-39119?

CVE-2021-39119 is a medium-severity vulnerability in Atlassian Data Center, classified under Incorrect Authorization. CVSS score: 5.3/10. Published 2021-09-01.

How severe is CVE-2021-39119?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Atlassian Data Center

CVE-2021-39119

Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0.

Vulnerability class: Broken Access Control

Published 2021-09-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.008 (55.0th percentile), scored 2026-11-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Atlassian Data Center
Atlassian Jira
Atlassian Jira Data Center — versions unspecified
Atlassian Jira Server — versions unspecified

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

jira.atlassian.com/browse/JRASERVER-72737 (Third Party Advisory)

Frequently asked questions

What is CVE-2021-39119?: CVE-2021-39119 is a medium-severity vulnerability in Atlassian Data Center, classified under Incorrect Authorization. CVSS score: 5.3/10. Published 2021-09-01.
How severe is CVE-2021-39119?: Medium severity. CVSS v3 base score is 5.3 out of 10.