-
Bug
-
Resolution: Not a bug
-
Medium
-
None
-
4.3.6
-
None
-
Confluence is running via Tomcat 6.0.32 on Windows Server 2008-64 bit. JDK: 1.7.0_07.
I have found what I believe to be a security bug in Confluence that should be fixed.
We have System Administrator function from the Confluence Administrator Group, and created a new Group called System Administrators (see attachment). The purpose was to give our Tech Writers the ability to access the Admin screen without giving them the ability to install add-ons. They belong to the Confluence-Administrators group, but not to the System-Administrators group.
However, I have found out that they have the ability to add themselves to the System-Administrators group. This allows them to increase their own authority and install add-ons.
They should not be able to add themselves to a group that has higher authority than they had.
[CONFSERVER-32541] Confluence Administrator Can Add Himself to System Administrator Group
Hi Chuck,
Thanks for taking the time to report this issue. Confluence treats the "confluence-administrators" group differently to other groups - it is exempt for permissions checks, and that can never be changed. This is known behaviour and so I'm going to close this issue as not a bug.
You can achieve the desired results by creating a new group, adding all the users you wish, and granting that group "administer confluence" permission.
Regards,
David Rizzuto
Confluence Bugmaster
Atlassian
David,
Thanks for your reply. We'll create a new user group and give that group "Confluence Administrator" permission. Then I'll put our Tech Writers in that group.
However, they have granted space and page permissions to the "confluence-administrators" group, that need to be replicated to the new group.
How do I query the database to find out which pages and spaces have special permissions assigned to the "confluence-administrators" group?
Thanks,
Chuck