A vulnerability in the sooperset mcp-atlassian server allows authenticated users to bypass security restrictions and access unauthorized Confluence or Jira data.

This is an improper access control vulnerability (CWE-284) where caller-supplied filter arguments can override administrator-configured allowlists. The flaw occurs within the search processing flow, specifically affecting the SearchMixin search functions, and requires an authenticated user to trigger.

The vulnerability poses a significant risk of unauthorized data exposure within Atlassian environments. By bypassing intended boundaries, an attacker with authenticated access can search and potentially retrieve sensitive information from Jira projects or Confluence spaces that were meant to be restricted. Given the CVSS score of 6.5, this medium-severity flaw represents a notable risk to internal data confidentiality and compliance requirements.

Immediate Action: Update the sooperset mcp-atlassian server to version 0.22.0 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review application logs for unusual search queries or high volumes of requests targeting projects and spaces outside of expected operational scopes.

Compensating Controls: Implement strict identity and access management policies for the service account used by the MCP server to ensure it only possesses the minimum permissions required for its intended function.

Public Exploit Available: No confirmed public exploit (exploit_available: unknown).

The ability for an authenticated user to bypass configured security boundaries represents a failure of the principle of least privilege. Administrators should prioritize the update to version 0.22.0 to restore proper access controls and ensure that search operations are correctly constrained by the defined allowlists.