What’s Vulnerable › Vulnerabilities

CVE-2022-41930: org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-11-23 · updated 2026-06-17
• Weakness: CWE-862

Description

org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.

Affected products

• xwiki-platform: from 12.4 before 13.10.7; from 14.0.0 before 14.4.2; 14.4.3, 14.4.4 — fixed in 13.10.7, 14.4.2

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.7, 14.4.2. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5v9-g8w8-5q4v
• https://jira.xwiki.org/browse/XWIKI-19792
• https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5v9-g8w8-5q4v
• https://jira.xwiki.org/browse/XWIKI-19792

Get alerted when CVE-2022-41930 or the next vulnerability affects your stack