# CVE-2026-53966: XWiki Platform Live Data privilege escalation through edit API

Source: https://junglewise.ai/threats/cve-2026-53966-xwiki-platform-live-data-privilege-escalation-through-edit-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-53966 · Severity: high · CVSS 4 · Published 2026-09-15

XWiki Platform is a collaborative wiki engine used to host team documentation and content. Users with basic edit permissions can abuse the Live Data feature's REST API to grant themselves script execution rights on a page, allowing them to run dangerous code and inject malicious content. This privilege escalation undermines the platform's permission model and can be exploited by any authenticated user to gain powerful capabilities.

Technologies: [XWiki Platform](https://junglewise.ai/threats/technologies/platform). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Xwiki](https://junglewise.ai/threats/vendors/xwiki).

## Quick answers

**Is CVE-2026-53966 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53966 being exploited in the wild.

**How severe is CVE-2026-53966?** High severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** org.xwiki.platform:xwiki-platform-livedata-livetable (Maven) ECOSYSTEM:introduced=13.4-rc-1,fixed=16.10.17; XWiki Platform >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0.

**Is there a fix for CVE-2026-53966?** Yes. org.xwiki.platform:xwiki-platform-livedata-livetable (Maven): upgrade to 16.10.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53966 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-53966?** Check whether you run org.xwiki.platform:xwiki-platform-livedata-livetable (Maven) or XWiki Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.xwiki.platform:xwiki-platform-livedata-livetable (Maven): upgrade to 16.10.17 or later

  ```sh
  # set org.xwiki.platform:xwiki-platform-livedata-livetable to 16.10.17 in your pom.xml or build.gradle
  ```


## Technical details

This is a missing authorization vulnerability (CWE-862) in XWiki's Live Data Live Table connector. The Live Data edit REST API fails to properly invoke authorization checks when processing document updates via inline cell editing. An attacker with edit rights can send requests that modify page-level permissions (via the XWiki.XWikiRights class) to grant themselves script execution rights. The vulnerability stems from insufficient validation in the document-saving logic introduced in XWIKI-18098. Attack requires network access and low-level privileges (edit right), with no user interaction needed. Once exploited, an attacker can execute Velocity macros and unfiltered HTML/JavaScript on the target page, and bypass security listeners. Patches are available in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0.

## Affected products

- XWiki XWiki Platform Live Data Live Table Connector >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0

## Identifiers

- CVE-2026-53966
- GHSA-45ph-gxxr-gwgw

## Timeline

- 2026-06-11: disclosed: Published to GitHub Advisory Database (GHSA-45ph-gxxr-gwgw)
- 2026-08-19: advisory: Advisory updated with CVSS v4 score of 7.1
- 2026-08-19: patched: Patches available in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0

## References

- [https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw)
- [https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626](https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626)
- [https://jira.xwiki.org/browse/XWIKI-23986](https://jira.xwiki.org/browse/XWIKI-23986)
- [https://api.github.com/repos/xwiki/xwiki-platform/security-advisories/GHSA-45ph-gxxr-gwgw](https://api.github.com/repos/xwiki/xwiki-platform/security-advisories/GHSA-45ph-gxxr-gwgw)

## Related threats

- [XWiki Platform missing authorization in REST API XAR import](https://junglewise.ai/threats/cve-2026-33137-xwiki-platform-missing-authorization-in-rest-api-xar-import)
- [XWiki Platform path traversal in ssx and jsx endpoints](https://junglewise.ai/threats/cve-2026-23734-xwiki-platform-path-traversal-in-ssx-and-jsx-endpoints)
- [XWiki privilege escalation via link refactoring](https://junglewise.ai/threats/cve-2025-49580-xwiki-privilege-escalation-via-link-refactoring)