XWiki Platform Vulnerability in Live Data Edit REST API
CVE-2026-53966
What is CVE-2026-53966?
The XWiki Platform contains a significant vulnerability in its Live Data edit REST API, which allows users with edit permissions to alter access rights of a page without undergoing standard authorization checks. This flaw can be exploited by malicious actors to grant themselves script execution rights, which may lead to the execution of unsafe Velocity scripts or unauthorized delivery of HTML and JavaScript content to client systems. Such vulnerabilities can undermine the integrity of a wiki environment and circumvent established security controls designed to protect user and document interactions. The issue has been resolved in specific updates, including versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.
Affected Version(s)
xwiki-platform >= 13.4-rc-1, < 16.10.17 < 13.4-rc-1, 16.10.17
xwiki-platform >= 17.0.0-rc-1, < 17.4.10 < 17.0.0-rc-1, 17.4.10
xwiki-platform >= 17.5.0-rc-1, < 17.10.4 < 17.5.0-rc-1, 17.10.4