Vulnerability-Lookup

CVE-2026-53966 (GCVE-0-2026-53966)

Vulnerability from cvelistv5 – Published: 2026-09-15 14:38 – Updated: 2026-09-15 18:03

Title

XWiki Platform: Privilege escalation from edit to script right through Live Data editing

Summary

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 17:38 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

10 references

URL	Tags
https://github.com/xwiki/xwiki-platform/security/…	x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/1d…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/44…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/77…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/fb…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/releases/…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/releases/…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/releases/…	x_refsource_MISC
https://github.com/xwiki/xwiki-platform/releases/…	x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-23986	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
xwiki	xwiki-platform	Affected: >= 13.4-rc-1, < 16.10.17 Affected: >= 17.0.0-rc-1, < 17.4.10 Affected: >= 17.5.0-rc-1, < 17.10.4 Affected: >= 18.0.0-rc-1, < 18.1.0-rc-1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53966",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T17:38:26.447862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T18:03:06.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 13.4-rc-1, \u003c 16.10.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0-rc-1, \u003c 17.4.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.5.0-rc-1, \u003c 17.10.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.0.0-rc-1, \u003c 18.1.0-rc-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page\u0027s rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:38:27.596Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10"
        },
        {
          "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1"
        },
        {
          "name": "https://jira.xwiki.org/browse/XWIKI-23986",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-23986"
        }
      ],
      "source": {
        "advisory": "GHSA-45ph-gxxr-gwgw",
        "discovery": "UNKNOWN"
      },
      "title": "XWiki Platform: Privilege escalation from edit to script right through Live Data editing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53966",
    "datePublished": "2026-09-15T14:38:27.596Z",
    "dateReserved": "2026-06-11T15:50:01.283Z",
    "dateUpdated": "2026-09-15T18:03:06.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53966",
      "date": "2026-09-19",
      "epss": "0.0033",
      "percentile": "0.26335"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 13.4-rc-1, \u003c 16.10.17"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 17.0.0-rc-1, \u003c 17.4.10"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 17.5.0-rc-1, \u003c 17.10.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 18.0.0-rc-1, \u003c 18.1.0-rc-1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page\u0027s rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1."
          }
        ],
        "id": "CVE-2026-53966",
        "lastModified": "2026-09-15T19:17:20.243",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53966",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T17:38:26.447862Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T15:17:17.533",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://jira.xwiki.org/browse/XWIKI-23986"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53966",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-15T17:38:26.447862Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-15T17:38:27.783Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "xwiki-platform",
              "vendor": "xwiki",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 13.4-rc-1, \u003c 16.10.17"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 17.0.0-rc-1, \u003c 17.4.10"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 17.5.0-rc-1, \u003c 17.10.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 18.0.0-rc-1, \u003c 18.1.0-rc-1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page\u0027s rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T14:38:27.596Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1"
            },
            {
              "name": "https://jira.xwiki.org/browse/XWIKI-23986",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://jira.xwiki.org/browse/XWIKI-23986"
            }
          ],
          "source": {
            "advisory": "GHSA-45ph-gxxr-gwgw",
            "discovery": "UNKNOWN"
          },
          "title": "XWiki Platform: Privilege escalation from edit to script right through Live Data editing"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-53966",
        "datePublished": "2026-09-15T14:38:27.596Z",
        "dateReserved": "2026-06-11T15:50:01.283Z",
        "dateUpdated": "2026-09-15T18:03:06.902Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53966

Vulnerability from fkie_nvd - Published: 2026-09-15 15:17 - Updated: 2026-09-15 19:17

Severity

7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1
	security-advisories@github.com	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw
	security-advisories@github.com	https://jira.xwiki.org/browse/XWIKI-23986

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 13.4-rc-1, \u003c 16.10.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0-rc-1, \u003c 17.4.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.5.0-rc-1, \u003c 17.10.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.0.0-rc-1, \u003c 18.1.0-rc-1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page\u0027s rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1."
    }
  ],
  "id": "CVE-2026-53966",
  "lastModified": "2026-09-15T19:17:20.243",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53966",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T17:38:26.447862Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T15:17:17.533",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://jira.xwiki.org/browse/XWIKI-23986"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-45PH-GXXR-GWGW

Vulnerability from github – Published: 2026-08-19 19:18 – Updated: 2026-08-19 19:18

Summary

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

Details

Impact

Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScript to the client. If there are other security checks, e.g., in extensions, implemented as listeners to UserUpdatingDocumentEvent and similar User… events, these checks can be circumvented, too.

Patches

This vulnerability has been patched by properly calling all checks in Live Data in XWiki 16.10.17, 17.4.10, 17.10.4 and 18.1.0.

Workarounds

We're not aware of any workarounds apart from upgrading.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livedata-livetable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.4-rc-1"
            },
            {
              "fixed": "16.10.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livedata-livetable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0-rc-1"
            },
            {
              "fixed": "17.4.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livedata-livetable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.5.0-rc-1"
            },
            {
              "fixed": "17.10.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livedata-livetable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "18.0.0-rc-1"
            },
            {
              "fixed": "18.1.0-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-19T19:18:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nAny user who can edit a page in XWiki can use Live Data\u0027s edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScript to the client. If there are other security checks, e.g., in extensions, implemented as listeners to `UserUpdatingDocumentEvent` and similar `User\u2026` events, these checks can be circumvented, too.\n\n### Patches\nThis vulnerability has been patched by properly calling all checks in Live Data in XWiki 16.10.17, 17.4.10, 17.10.4 and 18.1.0.\n\n### Workarounds\nWe\u0027re not aware of any workarounds apart from upgrading.",
  "id": "GHSA-45ph-gxxr-gwgw",
  "modified": "2026-08-19T19:18:04Z",
  "published": "2026-08-19T19:18:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-23986"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing"
}

WID-SEC-W-2026-1904

Vulnerability from csaf_certbund - Published: 2026-06-11 22:00 - Updated: 2026-06-11 22:00

Summary

xwiki (Live Data): Schwachstelle ermöglicht Privilegieneskalation

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2026-53966.

CVE-2026-53966

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53966 (GCVE-0-2026-53966)

FKIE_CVE-2026-53966

GHSA-45PH-GXXR-GWGW

Impact

Patches

Workarounds

WID-SEC-W-2026-1904

Tags

Sightings

Nomenclature

Related by attack behaviour