Atlassian released security advisory 2022-07-20 for CVE-2022-26138. The Confluence app Questions for Confluence creates the user disabledsystemuser with a hardcoded password. The presumably disabled user is added to the confluence-users group. As such, the account is able to login and access non-restricted pages by default. Fixed in Questions for Confluence 2.7.38 and 3.0.5. And the story gets more exciting. The account contact address is dontdeletethisuser(at)email.com. The domain belongs to the freemailer mail.com. 4chr4f2 showed on Twitter that this address was still available for anyone to register. Per the advisory, unpatched instances send their notification mails to that third-party address, which mail.com has since confirmed as blocked.
