CVE-2024-55876: XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-12-12 · updated 2026-06-17
Weakness: CWE-862

Description

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch.

Affected products

xwiki-platform: from 1.2.1 before 15.10.9; from 16.0.0 before 16.3.0; 1.2, 1.2-milestone2, 1.2-rc1, 1.2-rc2, 1.2-rc3 — fixed in 15.10.9, 16.3.0

How to fix

Upgrade to a fixed version: xwiki-platform 15.10.9, 16.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-55876 or the next vulnerability affects your stack