Unauthenticated privilege escalation via stored XSS

Stored XSS in Atlassian Confluence Data Center and Server allows remote attackers to execute arbitrary HTML or JavaScript in rendered content. Atlassian has not disclosed the affected endpoint or field, but the vendor record indicates that attacker-controlled markup is stored and later served without effective output neutralization, and that a related security misconfiguration broadens unauthenticated reachability. Exposure is limited to the affected release lines; when a higher-privileged session renders the stored payload, the attacker can act in that browser context and potentially gain broader access.