CVE-2019-8449: Atlassian Jira groupuserpicker endpoint allows unauthenticated username enumeration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is trivially reachable without authentication and has very high EPSS with public exploit code, though it only discloses usernames rather than direct access.

What it is

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 is missing authentication, letting remote attackers enumerate valid usernames. This matters because harvested account names feed credential stuffing, password spraying and social engineering against the Jira instance and connected services.

Impact

An attacker gains a list of valid Jira usernames without credentials, enabling targeted authentication attacks and user discovery. No data beyond usernames is exposed by this flaw itself.

Attack surface

Reachable over the network via the REST endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or intranet-exposed Jira instance below 8.4.0 is in scope.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.848, 99.7th percentile) and public exploit code exists per Packet Storm references, indicating active interest and easy weaponization.

What to do

• Upgrade Jira Server/Data Center to 8.4.0 or later; this is the only complete fix.
• If immediate upgrade is not possible, restrict access to /rest/api/latest/groupuserpicker at the reverse proxy or WAF and block unauthenticated requests.
• Limit network exposure of Jira to trusted networks or VPN rather than the public internet.
• Enforce strong authentication (MFA) and rate limiting on login endpoints to blunt username-based attacks.
• Monitor Atlassian advisories for backported fixes on supported branches.

Detection

• Alert on unauthenticated or anomalous requests to /rest/api/latest/groupuserpicker, especially high-volume or sequential query parameters.
• Baseline normal callers of the endpoint and flag new source IPs or user agents.
• Correlate enumeration bursts with subsequent failed login attempts or password spraying from the same source.
• Review web/proxy logs for the endpoint returning 200 responses to requests lacking session cookies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.