xwiki-platform up to 14.10.21/15.10.11/16.4.2/16.6.x REST Endpoint authorization

Summaryinfo

A vulnerability was found in xwiki-platform up to 14.10.21/15.10.11/16.4.2/16.6.x. It has been classified as problematic. Affected by this issue is some unknown functionality of the component REST Endpoint. This manipulation causes authorization. This vulnerability appears as CVE-2025-46554. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in xwiki-platform up to 14.10.21/15.10.11/16.4.2/16.6.x. Affected by this vulnerability is an unknown code block of the component REST Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. The summary by CVE is:

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-46554 since 04/24/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 14.10.22, 15.10.12, 16.4.3 or 16.7.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• xwiki-platform

Version

• 14.10.0
• 14.10.1
• 14.10.2
• 14.10.3
• 14.10.4
• 14.10.5
• 14.10.6
• 14.10.7
• 14.10.8
• 14.10.9
• 14.10.10
• 14.10.11
• 14.10.12
• 14.10.13
• 14.10.14
• 14.10.15
• 14.10.16
• 14.10.17
• 14.10.18
• 14.10.19
• 14.10.20
• 14.10.21
• 15.10.0
• 15.10.1
• 15.10.2
• 15.10.3
• 15.10.4
• 15.10.5
• 15.10.6
• 15.10.7
• 15.10.8
• 15.10.9
• 15.10.10
• 15.10.11
• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.4.0
• 16.4.1
• 16.4.2
• 16.5
• 16.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion