CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Executive brief

### Impact REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds We're not aware of any workarounds apart from upgrading the affected modules.

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g
• https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7
• https://jira.xwiki.org/browse/XWIKI-23550
• https://api.github.com/repos/xwiki/xwiki-platform/security-advisories/GHSA-mrqg-xmgm-rc5g