CVE Feed

    Dashboard / CVE / CVE-2026-53966

    CVE-2026-53966

    XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

    Published:Sep 15, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 15, 2026
    EPSS Score:
    CVSS Score:7.1

    Affected Products

    Vendor
    Xwiki
    Product
    Xwiki-platform

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-34151 (CVSS 8.2) — XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web…
    CVE-2026-48048 (CVSS 7.5) — XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insuffi…
    CVE-2026-48047 (CVSS 5.9) — XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and…
    CVE-2026-40105 (CVSS 6.5) — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versi…
    CVE-2026-26000 (CVSS 5.3) — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior…
    CVE-2026-24128 (CVSS 6.5) — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versi…
    CVE-2025-66473 (CVSS 8.7) — XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17…
    CVE-2025-66472 (CVSS 6.5) — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versi…
    CVE-2025-55749 (CVSS 8.7) — XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance whi…
    CVE-2025-52472 (CVSS 9.3) — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Start…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High