← Vulnerability feed

Vulnerability record · CVE-2021-20306 · published 1 June 2021

CVE-2021-20306: Redhat descision manager incorrect authorization vulnerability

Redhat · Descision Manager

A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.

4.3 CVSS 3.1 Medium EPSS 0.66% · top 50.1% CWE-863 · Incorrect authorization
4.3CVSS 3.1 base score, v2 4.0
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=1946213 Issue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1946213 Issue TrackingVendor Advisory

Track CVE-2021-20306 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.8CVE-2019-14892Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a mal…EPSS 5.6%9.6CVE-2025-12543Redhat build of apache camel improper input validation vulnerabilityA flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to pr…EPSS 1.3%9.1CVE-2026-28369Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly proce…EPSS 0.89%9.1CVE-2026-28368Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed diffe…EPSS 0.89%9.1CVE-2026-28367Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for…EPSS 0.89%8.8CVE-2022-1415Redhat decision manager deserialization of untrusted data vulnerabilityA flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated a…EPSS 1.0%8.8CVE-2019-14841Redhat decision manager vulnerabilityA flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to …EPSS 0.67%

Source: NIST National Vulnerability Database (record CVE-2021-20306), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.