nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Share confluence space with external user with read only view / bug: external user able to edit

Alexandra Bobrow (Instech)

If I share a confluence page to an external user, they receive an email about this, create an atlassian account, and can view the page. Any links on this page are also usable, meaning that they can essentially navigate the entire space. This is great. When navigating the space they do not have the ability to edit, with one exception...

So I went into Confluence and started editing a page. I copied the link to this editing page, thinking that I was just copying the normal page link, not realizing I was still in edit mode. I went into another Confluence page and created a link with the url I had copied. Since the url I copied was from the editing website, obviously upon clicking it I went directly to the page's editor. This is understandable given that I am a space admin and can edit. However, when an external user who I had shared this same page with clicked on the link, they too were able to edit, even though they have no other editing permissions otherwise. In theory it seems that anyone with access to the KB space who is able to "guess" the URL of the editing page has access to edit that page even if they normally would not.

Example: the website link I would like to share is https://myCompanyName.atlassian.net/wiki/spaces/servicedesk1/pages/1234567890/Name+Of+The+Page Now if I share this link with an external user they cannot edit it. However if they were to visit the following URL they would be able to edit this page even if I had not shared this specific link with them https://myCompanyName.atlassian.net/wiki/spaces/servicedesk1/pages/edit-v2/1234567890

I am a bit unsure as to how to change permissions for this confluence space for external users given this issue. In my opinion, this seems like an edge case and is probably a bug? I am assuming this is not meant to happen?

Accepted answers

KAGITHALA BABU ANVESH_z1zl10

Hi ,

When ever there is new user he might be added into "Confluence-users" group.

Please check the Space permissions

does edit permission is enabled to "Confluence-users".

if yes

created a new group for internal users to edit pages. enable edit permissions on pages to internal users group only.

Create a new group for external users. and add that group to space permissions and View permission only.

Dario B

Hello @Alexandra Bobrow (Instech) and @KAGITHALA BABU ANVESH ,

In Confluence Cloud you now have the possibility to use/configure Public Links. This way you can share content with external users without having to pay for extra license seats:

A public link is a special URL that directs to safe, view-only version of an individual Confluence page. The public link can be shared with anyone on the internet. This is a great way to share content with people like clients, vendors, and contractors without needing to pay for an extra seat on Confluence.

The ability to share public links is off by default. Only Confluence and site admins can allow public links in Confluence settings. With public links allowed, users will have the choice to disable or enable public links on individual Confluence pages.

For more details please see:

https://confluence.atlassian.com/ge/public-links-979425312.html

I hope this helps.

Cheers,
Dario

All comments

KAGITHALA BABU ANVESH_z1zl10

Hi ,

When ever there is new user he might be added into "Confluence-users" group.

Please check the Space permissions

does edit permission is enabled to "Confluence-users".

if yes

created a new group for internal users to edit pages. enable edit permissions on pages to internal users group only.

Create a new group for external users. and add that group to space permissions and View permission only.

Alexandra Bobrow (Instech)

Thanks for the help. Even if they are set as view/read only they are still considered licensed users that one must pay for correct?

KAGITHALA BABU ANVESH_z1zl10

Yes

Dario B

Hello @Alexandra Bobrow (Instech) and @KAGITHALA BABU ANVESH ,

In Confluence Cloud you now have the possibility to use/configure Public Links. This way you can share content with external users without having to pay for extra license seats:

A public link is a special URL that directs to safe, view-only version of an individual Confluence page. The public link can be shared with anyone on the internet. This is a great way to share content with people like clients, vendors, and contractors without needing to pay for an extra seat on Confluence.

The ability to share public links is off by default. Only Confluence and site admins can allow public links in Confluence settings. With public links allowed, users will have the choice to disable or enable public links on individual Confluence pages.

For more details please see:

https://confluence.atlassian.com/ge/public-links-979425312.html

I hope this helps.

Cheers,
Dario

KAGITHALA BABU ANVESH_z1zl10

Hi @Dario B ,

Thank you very much for the information.

Very useful.

Alexandra Bobrow (Instech)

Thanks Dario! This is really helpful. So glad to hear that this functionality exists!

Dario B

You are both very welcome!

This is a new feature, introduced not so long ago, so it is normal that is not well known yet.

In Cloud new features are released quite often and therefore I'd suggest, from time to time, to have a look at the documentation blog (or set yourself as a watcher) in order to be updated on any change that you might be interested about:

Atlassian Cloud Documentation blog posts

Another option is to check the Articles section here in the community for the monthly updates, like the below one:

What's New in Confluence Cloud – January 2021 Edition

Cheers,
Dario

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

cloud

confluence-cloud

permission

read-only