This vulnerability in Atlassian Confluence Data Center involves improper authorization that permits authenticated users with limited privileges to access resources or functionality beyond their intended scope. The issue affects multiple versions including 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Successful exploitation can lead to exposure of sensitive information or arbitrary code execution. Atlassian has released fixed versions starting at 9.2.24 and 10.2.17 to address this vulnerability.

An authenticated attacker with low privileges can exploit this improper authorization vulnerability to gain unintended access to sensitive resources or functionality within Confluence Data Center. This may result in exposure of sensitive information or potentially allow execution of arbitrary code, increasing the risk of system compromise.

Atlassian recommends upgrading affected Confluence Data Center instances to fixed versions: 9.2.24 or later for the 9.2.x line, and 10.2.17 or later for the 10.2.x line. If immediate upgrade is not possible, customers should plan to update as soon as feasible. No alternative mitigations or workarounds are specified in the advisory.