EUVD-2026-78592
GHSA-45ph-gxxr-gwgw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
REST API is network-reachable (AV:N); requires authenticated editor access (PR:L); scope changes because script right enables XSS impacting other users' browsers (S:C); integrity impact is high due to rights escalation.
Primary rating from Vendor (https://github.com/xwiki/xwiki-platform).
CVSS VectorVendor: https://github.com/xwiki/xwiki-platform
Lifecycle Timeline
4DescriptionCVE.org
Impact
Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScript to the client. If there are other security checks, e.g., in extensions, implemented as listeners to UserUpdatingDocumentEvent and similar User… events, these checks can be circumvented, too.
Patches
This vulnerability has been patched by properly calling all checks in Live Data in XWiki 16.10.17, 17.4.10, 17.10.4 and 18.1.0.
Workarounds
We're not aware of any workarounds apart from upgrading.
AnalysisAI
Privilege escalation in XWiki Platform's Live Data Live Table Connector allows any authenticated user with edit access to a page to elevate themselves to script right by sending crafted requests to the Live Data REST API. Script right in XWiki permits execution of arbitrary Velocity code and injection of unfiltered HTML and JavaScript into page content, enabling stored XSS against other users and bypassing extension-level security listeners. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated XWiki user account with at minimum edit permission on the target page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents a real and meaningful escalation path despite the absence of a vendor-provided CVSS vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade XWiki Platform to a patched release: 16.10.17, 17.4.10, 17.10.4, or 18.1.0 (released as 18.1.0-rc-1 per the advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, create an inventory of all XWiki Platform instances and identify which versions are currently deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today