CVE-2023-22518

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

• CWE-863
• CWE-863

• http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907Issue Tracking, Mitigation, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-93142Issue Tracking, Mitigation, Vendor Advisory
• http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907Issue Tracking, Mitigation, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-93142Issue Tracking, Mitigation, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518US Government Resource

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22510Rejected reason: To maintain compliance with CNA rules, we h…
• CVE-2023-22512This High severity DoS (Denial of Service) vulnerability was…7.5
• CVE-2023-22513This High severity RCE (Remote Code Execution) vulnerability…8.8
• CVE-2023-22514This High severity RCE (Remote Code Execution) vulnerability…7.8
• CVE-2023-22515Atlassian has been made aware of an issue reported by a hand…9.8
• CVE-2023-22516This High severity RCE (Remote Code Execution) vulnerability…8.8
• CVE-2023-2252The Directorist WordPress plugin before 7.5.4 is vulnerable …2.7
• CVE-2023-22520Rejected reason: To maintain compliance with CNA rules, we h…
• CVE-2023-22521This High severity RCE (Remote Code Execution) vulnerability…8.8
• CVE-2023-22522This Template Injection vulnerability allows an authenticate…8.8
• CVE-2023-22523This vulnerability, if exploited, allows an attacker to perf…8.8
• CVE-2023-22524Certain versions of the Atlassian Companion App for MacOS we…9.8