{"id":"CVE-2022-26138","aliases":["EUVD-2022-30705","GHSA-23xf-wg9r-49fr"],"status":"published","title":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a...","description":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.98241,"percentile":0.99916,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-798"],"published":"2022-07-20T17:25:26Z","modified":"2026-06-17T04:34:46Z","kev":{"date_added":"2022-07-29","due_date":"2022-08-19","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-07-29"},{"source":"kev","since":"2022-07-29"}],"exploits":[{"source":"pocgithub","id":"alcaparra/CVE-2022-26138","title":"alcaparra/CVE-2022-26138","date":"2022-07-21","url":"https://github.com/alcaparra/CVE-2022-26138"},{"source":"pocgithub","id":"Vulnmachines/Confluence-Question-CVE-2022-26138-","title":"Vulnmachines/Confluence-Question-CVE-2022-26138-","date":"2022-07-28","url":"https://github.com/Vulnmachines/Confluence-Question-CVE-2022-26138-"},{"source":"pocgithub","id":"z92g/CVE-2022-26138","title":"z92g/CVE-2022-26138","date":"2022-07-30","url":"https://github.com/z92g/CVE-2022-26138"},{"source":"pocgithub","id":"shavchen/CVE-2022-26138","title":"shavchen/CVE-2022-26138","date":"2022-09-01","url":"https://github.com/shavchen/CVE-2022-26138"},{"source":"nuclei","id":"CVE-2022-26138","title":"Atlassian Questions For Confluence - Hardcoded Credentials","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26138.yaml"}],"products":[{"vendor":"atlassian","product":"confluence"},{"vendor":"atlassian","product":"questions for confluence"},{"vendor":"atlassian","product":"questions_for_confluence"}],"references":[{"url":"https://jira.atlassian.com/browse/CONFSERVER-79483","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26138"},{"url":"https://github.com/advisories/GHSA-23xf-wg9r-49fr"}],"sources":{"cve":[{"id":"CVE-2022-26138","description":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.","status":"published","published":"2022-07-20T17:25:26.913Z","modified":"2026-01-12T21:22:06.527Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-30705","description":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.","status":"published","published":"2022-07-20T17:25:26Z","modified":"2026-01-12T21:22:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-07-29","updated_at":"2026-11-02T19:48:53.22038Z"}],"ghsa":[{"id":"GHSA-23xf-wg9r-49fr","title":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a...","description":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.","status":"published","published":"2022-07-21T00:00:27Z","modified":"2025-10-22T00:32:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2022-26138","title":"Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability","description":"Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.","cwes":["CWE-798"],"kev":{"date_added":"2022-07-29","due_date":"2022-08-19","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-26138","description":"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.","status":"published","published":"2022-07-20T18:15:08.617Z","modified":"2026-06-17T04:34:46.187Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:07:23.686531Z"}]}}