Executive brief
A vulnerability in the XWiki Discussion Extension allows an attacker to trick a user into unintentionally deleting messages. This occurs because the application does not properly verify that a delete request was intentionally sent by the user. An exploit could lead to unauthorized data removal and disruption of forum discussions.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the org.xwiki.contrib:discussions-server package. The root cause is that the message deletion endpoint is implemented using a GET request and lacks proper CSRF token validation. An attacker can exploit this by inducing an authenticated user to visit a malicious URL or web page, triggering a forged request that deletes messages on the user's behalf. This vulnerability is addressed in version 2.0-rc-1.
Affected products
- XWiki Contrib discussions-server < 2.0-rc-1
Timeline
- 2021-04-09: other: Issue reported in XWiki Jira
- 2021-10-25: patched: Issue resolved in Jira
- 2026-07-23: disclosed: GitHub Advisory published