CVE-2025-29924: XWiki uses the wrong wiki reference in AuthorizationManager

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-19 · updated 2026-06-17
Weakness: CWE-269

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through the REST API - but could also be through another API - when a sub wiki is using "Prevent unregistered users to view pages". The vulnerability only affects subwikis, and it only concerns specific right options such as "Prevent unregistered users to view pages". or "Prevent unregistered users to edit pages". It's possible to detect the vulnerability by enabling "Prevent unregistered users to view pages" and then trying to access a page through the REST API without using any credentials. The vulnerability has been patched in XWiki 15.10.14, 16.4.6 and 16.10.0RC1.

Affected products

xwiki-platform: from 6.1 before 15.10.14; from 16.0.0 before 16.4.6; from 16.5.0 through 16.10.0 — fixed in 15.10.14, 16.4.6

How to fix

Upgrade to a fixed version: xwiki-platform 15.10.14, 16.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-29924 or the next vulnerability affects your stack