XWiki Platform CVE-2026-48048

The target must be a running XWiki Platform instance in an affected version range (6.2.1 through 16.10.16, 17.0.0-rc-1 through 17.4.8, 17.5.0-rc-1 through 17.10.x prior to fix, or 18.x prior to 18.0.0RC1) with the standard xwiki-platform-livetable-ui module deployed, which is part of the default distribution. The LiveTableResults endpoint (typically /xwiki/bin/get/XWiki/LiveTableResults or wiki-equivalent path) must be reachable by the attacker, and the target user document and its XWikiUsers class must be queryable - by default this requires that guest or attacker-controlled accounts have view rights on the users wiki space, which is the default on many public XWiki deployments. Limiting factors: instances configured to deny anonymous read access on the XWiki space, or that have placed an authenticating reverse proxy in front of the LiveTable endpoint, significantly reduce exposure. No user interaction is required (UI:N) and no authentication is required per CVSS PR:N, though the prior bypass history makes it worth verifying that local hardening (e.g., wiki-level guest restrictions) is actually enforced.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) accurately reflects a network-reachable, unauthenticated, low-complexity information-disclosure flaw with no integrity or availability impact, which aligns with the technical evidence in the patch diff and test case. No EPSS score, SSVC decision, or CISA KEV entry was supplied in the input, so likelihood of mass exploitation cannot be quantitatively assessed; no public exploit identified at time of analysis. Real-world risk is elevated because (1) this is the second bypass of the same control, indicating the attack surface is well understood by researchers, (2) recovered hashes enable offline cracking and credential reuse against the same or other systems, and (3) the LiveTable endpoint is typically reachable to anonymous users on XWiki sites that allow guest viewing. Treat as a priority patch for any internet-exposed XWiki instance, especially those with guest read access enabled; lower priority for instances that already require authentication for all read operations.

An unauthenticated attacker on the internet sends a sequence of GET requests to the LiveTableResults endpoint of an exposed XWiki instance, each request supplying a target username, the password_class parameter pointing at the XWiki.XWikiUsers class, and a filter expression that asserts one bit of the stored password hash. By observing which requests return a row versus zero rows, the attacker reconstructs the full salt and hash in approximately 768 requests, then performs offline cracking with hashcat/john. No public exploit identified at time of analysis, but the patch diff and test case (noAccessToPasswordFieldsWithClassPerProperty) directly illustrate the parameter shape needed.