An authorization bypass vulnerability in sooperset mcp-atlassian allows authenticated users to execute restricted Jira and Confluence operations, posing a significant risk to data integrity and security.

This is a missing authorization flaw (CWE-862) occurring within the tool invocation workflow. While the server correctly filters tools during listing, it fails to revalidate these permissions during the tools/call request, allowing an authenticated client to access hidden or restricted functionality.

The ability to perform unauthorized read, write, or delete operations on Atlassian products like Jira and Confluence can lead to critical data loss, unauthorized information disclosure, and disruption of project management workflows. With a CVSS score of 8.8, this high-severity flaw represents a major threat to organizational data integrity and compliance, as it effectively undermines configured least-privilege security policies.

Immediate Action: Update the sooperset mcp-atlassian package to version 0.22.0 or later to resolve the authorization logic error.

Proactive Monitoring: Review application access logs for unexpected calls to sensitive tools or functions that should be restricted based on user roles.

Compensating Controls: Implement strict network-level access controls to limit the clients authorized to communicate with the MCP server until the update is applied.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the potential for unauthorized data manipulation within critical business environments. Security teams should prioritize the update to version 0.22.0 as soon as possible to restore proper authorization controls and prevent potential exploitation of the affected Atlassian integrations.