Read the docs
TI-2025-30434 Aliases CVE-2025-48063GHSA-rhfv-688c-p6hp

Improper authorization in xwiki-platform

Priority MEDIUM 55CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are editing documents on which required rights are enforced can be sure that they're not giving a right to a script or object that it didn't have before. A bug in the implementation of the enforcement of this rule means that in fact, it was possible for any user with edit right on a document to set programming right as required right. If then a user with programming right edited that document, the content of that document would gain programming right, allowing remote code execution. This thereby defeats most of the security benefits of required rights. As XWiki still performs the required rights analysis when a user edits a page even when required rights are enforced, the user with programming right would still be warned about the dangerous content unless the attacker managed to bypass this check. Note also that none of the affected versions include a UI for enabling the enforcing of required rights so it seems unlikely that anybody relied on them for security in the affected versions. As this vulnerability provides no additional attack surface unless all documents in the wiki enforce required rights, we consider the impact of this attack to be low even though gaining programming right could have a high impact. This vulnerability has been patched in XWiki 16.10.4 and 17.1.0RC1. No known workarounds are available except for upgrading.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01033 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed xwiki-platform (xwiki): 16.10.4, 17.1.0-rc-1org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven): 16.10.4, 17.1.0-rc-1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform16.10.0-rc-1 to before 16.10.4; 17.0.0-rc-1 to before 17.1.0-rc-116.10.4, 17.1.0-rc-1Patch availableCNA
—org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven)16.10.0-rc-1 to before 16.10.416.10.4Patch availableGHSA-rhfv-688c-p6hp
—org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven)17.0.0-rc-1 to before 17.1.0-rc-117.1.0-rc-1Patch availableGHSA-rhfv-688c-p6hp
  • xwiki-platform VendorXWiki Affected 16.10.0-rc-1 to before 16.10.4; 17.0.0-rc-1 to before 17.1.0-rc-1 Fixed in 16.10.4, 17.1.0-rc-1 Patch available CNA
  • org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven) Vendor— Affected 16.10.0-rc-1 to before 16.10.4 Fixed in 16.10.4 Patch available GHSA-rhfv-688c-p6hp
  • org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven) Vendor— Affected 17.0.0-rc-1 to before 17.1.0-rc-1 Fixed in 17.1.0-rc-1 Patch available GHSA-rhfv-688c-p6hp

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*16.10.0 to before 16.10.4VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:17.0.0:-:*:*:*:*:*:*17.0.0VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:17.0.0:rc1:*:*:*:*:*:*17.0.0 rc1VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 16.10.0 to before 16.10.4 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:17.0.0:-:*:*:*:*:*:* Versions 17.0.0 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:17.0.0:rc1:*:*:*:*:*:* Versions 17.0.0 rc1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 16.10.4, 17.1.0-rc-1
  • Fix · GHSA-rhfv-688c-p6hp org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven) Fixed in 16.10.4 Advisory →
  • Fix · GHSA-rhfv-688c-p6hp org.xwiki.platform:xwiki-platform-security-authorization-bridge (Maven) Fixed in 17.1.0-rc-1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48063
  2. 2026-10-03 Alias added: GHSA-rhfv-688c-p6hp

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences