CVE-2018-13394: Atlassian Questions For Confluence

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability.

Affected products

• Atlassian Questions For Confluence: before 2.6.6 (fixed in 2.6.6)

Published 2018-08-15. Last modified 2026-06-17.