CVE-2018-13391: The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version...

Security readout for executives and security teams

Certain Jira Server versions could reveal reporter and assignee email addresses to a remote user who can view an issue, even when email visibility is configured as hidden. This is a privacy and information-disclosure issue, not a direct system takeover based on the provided sources. Exposure is most likely on Jira Server instances in the listed affected version ranges where external, partner, contractor, or broadly permissioned users can view issues involving private user accounts. Treat this as a privacy-control failure with limited technical severity. Prioritize remediation if Jira contains regulated, customer, employee, or partner identities, or if non-employees can access issues. Mitigation focus: Upgrade affected Jira Server versions to the fixed versions or later supported releases.; Review Atlassian guidance for JRASERVER-67750 before applying operational changes.; Restrict issue-view permissions for external or low-trust users..

Prepared

Jun 7, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.