Steps to Reproduce:

1. In Confluence, visit the "My Profile" page (<confluence-url>/users/viewuserprofile.action)
2. Click "Edit Profile"
3. Note that no atl_token is present in the URL.
4. Click "Settings" (<confluence-url>/users/viewmysettings.action)
5. Click "Edit"
6. Note that the atl_token value is present in the URL.

Cause

Some forms are rendered as having the method GET rather than the method POST

Security implications

It is only an exploitable security issue if an attacker can get somehow get a resource that includes the token in the URL to access one of their resources or similar such that the referer of the request contains the csrf token.