The vulnerability allows an unauthenticated attacker to store malicious HTML or JavaScript into Confluence content, which is then rendered in the browsers of all users who view that content. Once the attacker induces victim browsers to execute the payload, they can perform actions as a higher‑privileged user, effectively compromising the instance. The flaw arises from insufficient input validation and misconfigured content rendering. The impact spans confidentiality, integrity, and availability, as attackers can hijack sessions, exfiltrate data, or modify content.

Affecting Atlassian Confluence Data Center and Atlassian Confluence Server. All releases from 7.1.1 up to and including 10.2.0 are vulnerable. Within the 9.2 series, patches begin at version 9.2.21, and for 10.2 the fix starts at 10.2.13. Any instance running a version prior to these fixed releases remains at risk.

The CVSS score of 8.6 denotes high severity. No EPSS score is available, but the vulnerability is not listed in CISA KEV, indicating no currently known active exploitation campaigns. Nevertheless, because the flaw enables arbitrary code execution in end‑user browsers and privilege escalation, systems with this weakness are attractive targets. Attackers could deploy the XSS payload via unauthenticated web requests and then leverage elevated privileges once a victim’s session is compromised. The theoretical risk high regardless of the lack of public exploitation evidence.