{"id":"CVE-2022-26138","kind":"vulnerability","aliases":["CVE-2022-26138"],"related":[],"title":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account…","description":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.","summary":"Questions for Confluence app (Server/Data Center only; Cloud not affected) creates a user 'disabledsystemuser' with a hardcoded, publicly known password, in the confluence-users group. An unauthenticated attacker can log in and read pages that group can view. Uninstalling the app does NOT remove the account, so instances are affected if the account exists even when the app is gone.","severity":"critical","cvss":9.8,"epss":0.98241,"exploited":true,"exploited_at":"2022-07-29T00:00:00+00:00","products":[{"name":"Atlassian Confluence","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Questions for Confluence","fixed":["2.7.38","3.0.5"],"affected":"2.7.34, 2.7.35, 3.0.2 (and any instance still holding the disabledsystemuser account)","ecosystem":"vendor"},{"name":"atlassian questions for confluence","fixed":[],"affected":"= 2.7.34","ecosystem":"vendor"},{"name":"atlassian questions for confluence","fixed":[],"affected":"= 2.7.35","ecosystem":"vendor"},{"name":"atlassian questions for confluence","fixed":[],"affected":"= 3.0.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["atlassian","confluence","exploited","hardcoded-credentials","questions-for-confluence","self-hosted","vendor"],"not_affected_if":["app-not-installed","confluence-cloud","managed-hosting","no-disabledsystemuser-account"],"how_to_check":"In Confluence user management, look for an active user with username disabledsystemuser and email dontdeletethisuser@email.com. If it is absent, you are not affected. It can exist after the app was installed and then uninstalled. Check its last logon time (null means nobody ever logged in), and check SMTP logs for mail sent to dontdeletethisuser@email.com.","fix":"Option 1: update Questions for Confluence to 2.7.38 or later on the 2.7.x line (Confluence 6.13.18 to 7.16.2), or to 3.0.5 or later (Confluence 7.16.3 and later). Fixed versions remove the account. Option 2: disable or delete the disabledsystemuser account. If you delete it, you must also upgrade or uninstall the app, or the account is recreated. Use option 2 if Confluence uses a read-only external directory such as Crowd.","status":"open","published_at":"2022-07-20T18:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:11:04+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T21:11:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Atlassian update for the Questions For Confluence app per vendor instructions; the specific fixed version is unknown from the sources.","reach":"internet","impact":"medium","summary":"The Atlassian Questions For Confluence app shipped with hard-coded username and password credentials. An unauthenticated remote attacker can log into Confluence with them and read all content visible to the confluence-users group.","category":"vendor","who_cares":["confluence","self-hosted","atlassian"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker logs in with hard-coded credentials and reads Confluence content.","analyst_note":"Find the fixed app version and the check for whether the app is installed at https://confluence.atlassian.com/ or Atlassian security advisories; the sources do not name them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","app-not-installed"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000468,"input_tokens":2868,"output_tokens":362,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed app version and the check for whether the app is installed at https://confluence.atlassian.com/ or Atlassian security advisories; the sources do not name them.","search":"'-2022':19A,22A '-26138':20A,23A '2.7.34':185C '2.7.35':186C '3.0.2':188C 'access':165C,168C 'account':17A,101B,108B,132C,179C 'affect':64B,105B 'app':6A,58B,96B,113B,121C,191C 'atlassian':2A,24A,29A,33A,37A,41B,117C 'attack':83B,150C 'center':12A,60B,127C 'cloud':62B 'confluenc':5A,8A,15A,42B,50B,57B,78B,120C,123C,130C,136C,163C,174C 'confluence':25A,28A,32A,36A,40A 'confluence-us':77B,135C,173C 'content':167C 'could':157C 'creat':13A,65B,128C,181C 'credenti':46B 'cve':18A,21A 'data':11A,126C 'disabledsystemus':68B,142C 'even':110B 'exist':109B 'exploit':43B,158C 'for':27A,31A,35A,39A 'gone':115B 'group':80B,91B,138C,176C 'hardcod':45B,71B,145C,155C 'hardcoded-credenti':44B 'host':53B 'instal':183C 'instanc':103B 'knowledg':152C 'known':73B 'log':85B,161C 'page':89B 'password':74B,146C,156C 'public':72B 'question':3A,48B,55B,118C 'questions':26A,30A,34A,38A 'questions-for-conflu':47B 'read':88B 'remot':148C 'remov':99B 'self':52B 'self-host':51B 'server':9A,124C 'server/data':59B 'unauthent':82B,149C 'uninstal':94B 'user':16A,67B,79B,131C,137C,170C,175C,178C 'usernam':141C 'vendor':54B 'version':184C 'view':93B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-07-20T18:15:08+00:00","kev":{"dateAdded":"2022-07-29","dueDate":"2022-08-19","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26138","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26138","severity":null,"published_at":"2022-07-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2022-26138","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26138","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-26138:48","url":null,"severity":null,"published_at":"2026-10-23T21:16:48+00:00","modified_at":"2026-10-23T21:16:48+00:00","first_seen_at":"2026-10-23T21:16:48+00:00","fetched_at":"2026-10-23T21:16:48+00:00","note":"Read Atlassian advisory 2022-07-20 (primary). Fixed versions and account check are stated there. Password was publicly disclosed on Twitter and Atlassian reports exploitation in the wild. I did not look for a public PoC link."},{"source":"nvd","external_id":"CVE-2022-26138","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26138","severity":null,"published_at":"2022-07-20T18:15:08+00:00","modified_at":"2026-06-17T04:34:46+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":922,"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html","title":"Questions For Confluence Security Advisory 2022-07-20","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}