What is the CVSS score of CVE-2026-48048?

CVE-2026-48048 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of XWiki Platform are affected by CVE-2026-48048?

XWiki Platform contains an information disclosure vulnerability in its LiveTableResults macro that allows unauthenticated remote attackers to extract password hash data through repeated requests,…. A patch is available.

How to fix or mitigate CVE-2026-48048?

24 hours: Identify all XWiki Platform instances and document current versions in your environment. 7 days: Obtain and apply available vendor security patch for CVE-2026-48048 per XWiki security advisory. 30 days: Verify patch deployment across all instances and monitor logs for exploitation indicators.

XWiki Platform CVE-2026-48048

HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-05-26 https://github.com/xwiki/xwiki-platform

GHSA-rh28-mqj4-8x59

Information Disclosure Atlassian

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 26, 2026 - 21:03 vuln.today

Analysis Generated

May 26, 2026 - 21:03 vuln.today

DescriptionGitHub Advisory

Impact

XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient and with slightly modified parameters to the LiveTableResults, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user.

Patches

The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17.

Workarounds

The patch can be applied manually to the wiki page XWiki.LiveTableResultsMacros.

Resources

https://jira.xwiki.org/browse/XWIKI-23875
https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa

AnalysisAI

Information disclosure in XWiki Platform's LiveTableResults macro allows unauthenticated remote attackers to reconstruct user password hashes and salts one bit at a time by sending approximately 768 crafted requests with manipulated class-per-property parameters. This is a bypass of the prior fix for GHSA-5cf8-vrr8-8hjm, which failed to account for an alternate parameter path. No public exploit is identified at time of analysis, but the technique is fully described in the vendor advisory.

Technical ContextAI

XWiki Platform is a Java-based open-source enterprise wiki built on the org.xwiki.platform Maven modules. The vulnerable component is xwiki-platform-livetable-ui, specifically the LiveTableResultsMacros Velocity template which renders queryable, sortable result tables for XWiki classes. The root cause maps to CWE-359 (Exposure of Private Personal Information). The original protection inspected $class.get($colname) to detect Password and Email property types and exclude them from query results, but the check was scoped to the document's primary XClass. By supplying a <column>_class parameter (e.g., password_class=XWiki.MyClass) the attacker forces the macro down a class-per-property code path where the password/email type check was not applied, allowing the field to participate in WHERE clauses. Boolean-style differential queries on individual hash bits then leak the bcrypt-style hash and salt across ~768 requests (8 bits × ~96 hex/base-N comparisons).

RemediationAI

Vendor-released patch: upgrade to XWiki 16.10.17, 17.4.9, 17.10.13 (note the GHSA package data lists 17.10.3 as the fix for the 17.10 line - verify against the advisory), or 18.0.0RC1 or later, available from the XWiki project per GHSA-rh28-mqj4-8x59. If immediate upgrade is not possible, apply the upstream commit c4442716b02ffcdaa9d5e703b1db6203e36456fa manually to the wiki page XWiki.LiveTableResultsMacros as described in the advisory workaround section; this introduces the #livetable_getPropertyClassAndType macro that correctly resolves the property class when a per-column class parameter is supplied. Compensating controls for instances that cannot be patched include disabling guest/anonymous access to the wiki (forces attackers to first acquire an account, raising cost but not eliminating the issue for authenticated insiders), restricting network access to the /xwiki/bin/get/XWiki/LiveTableResults endpoint via reverse-proxy ACLs (may break legitimate dashboards and admin UIs that rely on LiveTable), and rotating all user passwords after patching since prior hash exposure cannot be ruled out.