CVE-2021-26085: 
Confluence Server vulnerability analysis and mitigation

CVE-2021-26085 is a Pre-Authorization Arbitrary File Read vulnerability affecting Atlassian Confluence Server. The vulnerability was discovered by Amit Laish from GE Digital's Cyber Security Lab and was disclosed in July 2021. The affected versions include Confluence Server and Data Center versions before 7.4.10, and versions from 7.5.0 before 7.12.3 (Atlassian JIRA).

The vulnerability exists in the /s/ endpoint of Confluence Server, allowing remote attackers to view restricted resources through a Pre-Authorization Arbitrary File Read vulnerability. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction (AttackerKB).

The vulnerability allows unauthorized remote attackers to access and read restricted resources on affected Confluence Server instances. The impact primarily affects confidentiality with a Low rating, while having no direct impact on system integrity or availability (AttackerKB).

Atlassian has released fixed versions to address this vulnerability. Organizations should upgrade to version 7.4.10, 7.12.3, 7.13.0, or later versions to mitigate the vulnerability (Atlassian JIRA).