Live › vulnerability › CVE-2022-26138
Go to dashboardQuestions for Confluence app (Server/Data Center only; Cloud not affected) creates a user 'disabledsystemuser' with a hardcoded, publicly known password, in the confluence-users group. An unauthenticated attacker can log in and read pages that group can view. Uninstalling the app does NOT remove the account, so instances are affected if the account exists even when the app is gone.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Atlassian Confluence | vendor | – | – |
| Questions for Confluence | vendor | 2.7.34, 2.7.35, 3.0.2 (and any instance still holding the disabledsystemuser account) | 2.7.38, 3.0.5 |
| atlassian questions for confluence | vendor | = 2.7.34 | – |
| atlassian questions for confluence | vendor | = 2.7.35 | – |
| atlassian questions for confluence | vendor | = 3.0.2 | – |
2.7.38 or later on the 2.7.x line (Confluence 6.13.18 to 7.16.2), or to 3.0.5 or later (Confluence 7.16.3 and later)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
This page as .md · .json · in your agent: get_signal("CVE-2022-26138")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.