CVE-2021-43949: Atlassian Jira Service Management

Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0.

Affected products

• Atlassian Jira Service Management: before 4.21.0 (fixed in 4.21.0)

Published 2022-01-10. Last modified 2026-06-17.