EUVD-2026-46326
GHSA-5vfq-26hx-8v79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network, unauthenticated, no UI (AV:N/PR:N/UI:N); AC:H reflects the 4.0 AT:P attack requirement; confidentiality-only impact so C:H, I:N, A:N.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
Lifecycle Timeline
2DescriptionCVE.org
This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.
This Information Disclosure vulnerability, with a CVSS Score of 8.2, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability.
Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.22
Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.14
See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).
This vulnerability was reported via our Atlassian (Internal) program.
AnalysisAI
Information disclosure in Atlassian Confluence Data Center allows an unauthenticated remote attacker to read sensitive information from affected instances, carrying a CVSS 4.0 score of 8.2 (High). The flaw was introduced across a wide span of releases (7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, 10.2.0) and was found internally by Atlassian. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes patching a priority for internet-facing deployments.
Technical ContextAI
Confluence Data Center is Atlassian's self-managed, clustered enterprise wiki and collaboration platform (CPE cpe:2.3:a:atlassian:confluence_data_center) typically deployed on-premises or in customer-managed infrastructure, often internet-facing for distributed teams. The issue is an Information Disclosure weakness; Atlassian did not assign a specific CWE (CWE: N/A in the input), but the class corresponds to unauthorized exposure of sensitive data (CWE-200 family) reachable over the network without credentials. The CVSS 4.0 vector's AT:P (Attack Requirements Present) signals that successful exploitation depends on a condition beyond simply reaching the service, and the impact metrics VC:H/VI:N/VA:N confirm the effect is purely a loss of confidentiality with no integrity or availability impact.
RemediationAI
Vendor-released patch: upgrade Confluence Data Center to the latest version, or to a fixed maintenance release for your line - 9.2 customers should move to 9.2.22 or greater, and 10.2 customers to 10.2.14 or greater. Consult the Atlassian advisory at https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345 and the CONFSERVER-104340 ticket (https://jira.atlassian.com/browse/CONFSERVER-104340), obtain builds from the Atlassian download archives (https://www.atlassian.com/software/confluence/download-archives), and review release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). If immediate upgrade is not possible, reduce exposure by removing the instance from direct internet reachability and placing it behind a VPN or IP allowlist / reverse proxy so only trusted networks can reach it, and monitor access logs for anomalous requests to sensitive endpoints - with the trade-off that restricting network access can break external collaborators or integrations that rely on direct connectivity. No vulnerability-specific vendor workaround was published in the provided data, so upgrading remains the only confirmed fix.
More in Confluence Data Center
View allAll versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. Rated high severity
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza
This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. Rated high s
This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center a
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject u
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today