Description
Users can manually subscribe to pages which they are not authorized to view, hence receiving any future comments made on these pages.
Remediation
Upgrade Confluence to version 6.2.1 or above (recommended)
References
SEC Consult Vulnerability Lab Security Advisory 20170613-0
Access Restriction Bypass using watch notifications (CVE-2017-9505)