CVE-2021-26084 - Mitigation by Turning off "Allow people to sign up to create their account"

[David Klebanoff]

With respect to this vulnerability, do we have to run the mitigation script at all if we have "Allow people to sign up to create their account" turned off ?

[Malcolm Ninnes]

Atlassian recommends running the workaround/mitigation script even if 'Allow people to sign up to create their own account' is disabled.  There are several endpoints identified that expose Confluence to CVE-2021-26084, so applying the workaround script will temporarily mitigate against the known vulnerable end points until you can upgrade to a version that fixes this permanently.

We've reworded the advisory (Confluence Security Advisory CVE-2021-26084 - OGNL injection - 2021-08-25) to remove any ambiguity.  

[Kian Stack Mumo Systems]

My reading of the vulnerability would say no, but I would defer to Atlassian if they say something different. A lot of people have the same question on this ticket. I would add yourself as a watcher to see if Atlassian responds with confirmation.