MCP Atlassian is a Model Context Protocol server that forwards requests to Atlassian Confluence and Jira. The vulnerability resides in the JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER components. These components fail to enforce forbidden‑project clauses when processing search and board API requests. As a result, an operator who has credentials that grant broader access can construct queries that refer to disallowed project or space identifiers and retrieve data that lies outside the intended scopes. This yields unauthorized reading of issues, boards, or pages, effectively allowing data exfiltration from protected projects or spaces. The flaw is a classic incorrect authorization weakness, classified as CWE‑1276.

The affected system is the MCP Atlassian server developed by SooperSet. Any deployment running a version earlier than 0.22.0 is vulnerable. The server is used as a gateway to Atlassian Confluence and Jira, so users interacting with the server via authorized APIs can trigger the bypass.

The CVSS score of 8.3 reflects a high impact on confidentiality. Exploitation requires the attacker to possess operator credentials that are already authorized to perform search or board API calls. The EPSS score is not available, so the current probability of exploitation cannot be quantified. The issue is not listed in CISA KEV, indicating that no publicly known exploits have been reported. The likely attack vector is through authenticated API calls made by privileged operators, suggesting that privilege escalation or compromised credentials could be the initial step.