---
id: "CVE-2022-26138"
kind: "vulnerability"
aliases: ["CVE-2022-26138"]
title: "The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account\u2026"
severity: "critical"
cvss: 9.8
epss: 0.98241
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Atlassian Confluence", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Questions for Confluence", "fixed": ["2.7.38", "3.0.5"], "affected": "2.7.34, 2.7.35, 3.0.2 (and any instance still holding the disabledsystemuser account)", "ecosystem": "vendor"}, {"name": "atlassian questions for confluence", "fixed": [], "affected": "= 2.7.34", "ecosystem": "vendor"}, {"name": "atlassian questions for confluence", "fixed": [], "affected": "= 2.7.35", "ecosystem": "vendor"}, {"name": "atlassian questions for confluence", "fixed": [], "affected": "= 3.0.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["atlassian", "confluence", "exploited", "hardcoded-credentials", "questions-for-confluence", "self-hosted", "vendor"]
not_affected_if: ["app-not-installed", "confluence-cloud", "managed-hosting", "no-disabledsystemuser-account"]
published_at: "2022-07-20T18:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26138", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26138", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:16:48+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26138", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account…

Questions for Confluence app (Server/Data Center only; Cloud not affected) creates a user 'disabledsystemuser' with a hardcoded, publicly known password, in the confluence-users group. An unauthenticated attacker can log in and read pages that group can view. Uninstalling the app does NOT remove the account, so instances are affected if the account exists even when the app is gone.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Confluence affected ? fixed ?
- vendor:Questions for Confluence affected 2.7.34, 2.7.35, 3.0.2 (and any instance still holding the disabledsystemuser account) fixed 2.7.38, 3.0.5
- vendor:atlassian questions for confluence affected = 2.7.34 fixed ?
- vendor:atlassian questions for confluence affected = 2.7.35 fixed ?
- vendor:atlassian questions for confluence affected = 3.0.2 fixed ?

## How to check

In Confluence user management, look for an active user with username disabledsystemuser and email dontdeletethisuser@email.com. If it is absent, you are not affected. It can exist after the app was installed and then uninstalled. Check its last logon time (null means nobody ever logged in), and check SMTP logs for mail sent to dontdeletethisuser@email.com.

## Fix

Option 1: update Questions for Confluence to 2.7.38 or later on the 2.7.x line (Confluence 6.13.18 to 7.16.2), or to 3.0.5 or later (Confluence 7.16.3 and later). Fixed versions remove the account. Option 2: disable or delete the disabledsystemuser account. If you delete it, you must also upgrade or uninstall the app, or the account is recreated. Use option 2 if Confluence uses a read-only external directory such as Crowd.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26138
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-26138
- 2026-10-23T21:16:48+00:00 analyst — Read Atlassian advisory 2022-07-20 (primary). Fixed versions and account check are stated there. Password was publicly disclosed on Twitter and Atlassian reports exploitation in the wild. I did not look for a public PoC link.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26138

## Documents

- [advisory] Questions For Confluence Security Advisory 2022-07-20 https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html

## From the sources

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_