Multiple warnings of "isAccessible Access to non-public [...] is blocked!"
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
In Confluence's application logs, there are many WARN entries similar to the ones below:
2023-11-10 19:33:38,617 WARN [http-nio-8090-exec-3 url: /, /dashboard.action; user: admin] [opensymphony.xwork2.ognl.SecurityMemberAccess] isAccessible Access to non-public [protected com.atlassian.confluence.setup.settings.SettingsManager com.atlassian.confluence.core.ConfluenceActionSupport.settingsManager] is blocked!
-- url: / | userName: admin | traceId: 3e847c830d995d492024-01-17 16:34:01,920 WARN [http-nio-8090-exec-10 url: /confluence/display/KEY/Page, /confluence/pages/viewpage.action] [opensymphony.xwork2.ognl.SecurityMemberAccess] isAccessible Access to non-public [private java.lang.String com.atlassian.confluence.security.actions.NotPermittedAction.title] is blocked!
-- url: /confluence/display/KEY/Page | userName: anonymous | traceId: 0fc6bad86fde325cEnvironment
These warnings can be seen in Confluence Data Center 7.19.17 and above, until 8.6.2 and 8.7.0.
Cause
These warnings are related to security fixes implemented in recent Confluence versions. A bug ticket was raised to address the spamming, CONFSERVER-93210 - Getting issue details... STATUS , which has been fixed in versions 8.6.2 and 8.7.0.
If you have any concerns regarding strange activity in your Confluence server, we recommend reaching out to your security team for further analysis.