Executive brief
XWiki Platform is a collaborative wiki engine used to host team documentation and content. Users with basic edit permissions can abuse the Live Data feature's REST API to grant themselves script execution rights on a page, allowing them to run dangerous code and inject malicious content. This privilege escalation undermines the platform's permission model and can be exploited by any authenticated user to gain powerful capabilities.
Technical details
This is a missing authorization vulnerability (CWE-862) in XWiki's Live Data Live Table connector. The Live Data edit REST API fails to properly invoke authorization checks when processing document updates via inline cell editing. An attacker with edit rights can send requests that modify page-level permissions (via the XWiki.XWikiRights class) to grant themselves script execution rights. The vulnerability stems from insufficient validation in the document-saving logic introduced in XWIKI-18098. Attack requires network access and low-level privileges (edit right), with no user interaction needed. Once exploited, an attacker can execute Velocity macros and unfiltered HTML/JavaScript on the target page, and bypass security listeners. Patches are available in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0.
Affected products
- XWiki XWiki Platform Live Data Live Table Connector >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database (GHSA-45ph-gxxr-gwgw)
- 2026-08-19: advisory: Advisory updated with CVSS v4 score of 7.1
- 2026-08-19: patched: Patches available in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0