Pre‑Auth Arbitrary File Read in Atlassian Confluence Server (CVE‑2021‑26085) Threatens Sensitive Data
What It Is — A pre‑authorization arbitrary file read flaw in the /s/ endpoint of Atlassian Confluence Server allows an unauthenticated attacker to retrieve files that should be restricted to authenticated users.
Exploitability — Publicly disclosed; proof‑of‑concept code exists; CVSS v3.1 base score 7.5 (High). No known active exploit campaigns, but the vulnerability is trivial to weaponize.
Affected Products — Atlassian Confluence Server versions prior to the security patch released in March 2022 (all on‑premises deployments).
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in access‑control enforcement that can be detected through continuous monitoring of authentication and file‑access logs.
- Provides evidence that a lack of proper pre‑authorization checks can undermine audit‑ready evidence of data segregation.
- Enterprise buyers increasingly demand verifiable controls (e.g., “no unauthenticated file reads”) as part of a defensible trust posture.
Recommended Actions
- Apply Atlassian’s security patch for CVE‑2021‑26085 immediately.
- Review and harden web‑application firewall (WAF) rules to block unexpected
/s/requests from unauthenticated sources. - Enable detailed request logging and set up alerts for file‑read attempts without a valid session.
- Conduct a post‑patch validation to confirm that unauthorized file reads are no longer possible.
- Map the remediation to your access‑control control objective and capture evidence for audit purposes.
Source: CISA KEV – CVE‑2021‑26085