2026-09-09 - Stored HTML/CSS Injection in the Administration UI

Summary

This advisory discloses a high-severity Stored HTML/CSS Injection vulnerability affecting all versions of User Management and License Optimizer for Jira, Confluence and Bitbucket prior to 6.6.1 and 6.6.1-p8. A low-privileged user could inject HTML and CSS into the app's administration UI, where it is rendered in the browser of a system administrator. Please upgrade your app installation to version 6.6.1/6.6.1-p8 or later to fix this vulnerability.

Details

The app did not properly sanitize certain user-controlled data when rendering its administration UI. Under specific circumstances, this could allow an attacker to inject arbitrary HTML and styles into pages viewed by a system administrator, altering content or exfiltrating it, including the XSRF token that protects the administrator against cross-site request forgery, as well as injecting elements that would, when clicked by the administrator, constitute a CSRF attack.

For a successful attack, the following requirements must be met:

• The attacker must have a user account on the instance or in one of its connected user directories. Depending on the configuration, such an account can be obtained without the involvement of an administrator, for example through self sign-up.

• The victim must be a system administrator who opens the app's administration UI.

For the full potential of the attack to be realized:

• The attacker must then successfully execute an XSRF attack on the victim.

Confluence and Bitbucket instances are affected as well, even if they do not allow self sign-up. It is sufficient that a connected user directory (for example a Jira user server, Crowd, or LDAP) contains an account prepared by an attacker.

What You Need to Do

Step 1: Mitigation

Update the app to version 6.6.1/6.6.1-p8 or later. After upgrading, user-supplied values are rendered as plain text in the affected pages of the app's administration UI.

In Case You Can't Update

If you can't update the app right away, the following measures reduce your exposure until you can:

• Restrict self sign-up. If you don't need users to be able to create accounts themselves (for example via public sign-up or a customer portal), disable this until you have updated. Note that existing users in a writable user directory can still change their own account details, and the products offer no supported setting to prevent that, so this measure only limits who can attempt an attack and is not a substitute for the update.

• Restrict changes to account details. If you need to close this path as well until you have updated, you can block the product's profile-editing endpoints in your load balancer or reverse proxy. Please contact us through our support portal if you need the list of endpoints for your product. This does not cover account details that are synchronized from an external source such as an identity provider or LDAP directory. Those can only be restricted at the source.

• Content Security Policy. As a partial workaround, you could configure a rule in your load balancer or reverse proxy to extend Atlassian's built-in CSP header to include a style-src directive ('self'). However, this may break the instance or other apps, and it only prevents content extraction, such as the XSRF token, while still allowing content to be defaced and HTML to be injected. Upgrading is strongly recommended.

Step 2: Impact Analysis

If you would like to check whether this vulnerability has been exploited on your instance, please contact us through our support portal. We will provide you with a procedure to look for indicators of exploitation and help you interpret the results. We are deliberately not publishing the details of this check at this time and may add them to this advisory at a later date.

Support

If you have any questions or need assistance, please contact us through our support portal.