CVE-2021-26085: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Published Aug 3, 2021 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Atlassian vulnerabilities
All Atlassian entriesCVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
critical7.5ExploitedOct 5, 2026CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
critical9.8ExploitedJan 16, 2024CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
critical9.8ExploitedOct 31, 2023CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
critical9.8ExploitedOct 4, 2023CVE-2022-36804
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
high8.8ExploitedAug 25, 2022CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
critical9.8ExploitedJul 20, 2022