XWiki Platform CVE-2026-53966

Exploitation requires a valid authenticated XWiki user account with at minimum edit permission on the target page. The xwiki-platform-livedata-livetable module must be present, which is standard in affected XWiki Platform installations - no non-default configuration is necessary. The attacker targets the Live Data REST API directly, manipulating editable document properties such as the rights levels field. Unauthenticated users cannot exploit this; the privilege floor is an authenticated editor. The rights escalation is scoped to the specific page the attacker already has edit access to, but once script right is obtained on that page, the impact extends to all users who view it via stored XSS or Velocity execution. Extension-level security checks based on UserUpdatingDocumentEvent listeners are also bypassed, which may widen impact in deployments relying on custom access control logic.

This vulnerability presents a real and meaningful escalation path despite the absence of a vendor-provided CVSS vector. The attack is network-reachable via the Live Data REST API and requires only authenticated access at the edit-permission level - a low bar in collaborative wiki environments where many users routinely hold edit rights. The impact is disproportionate: escalating to script right enables arbitrary server-side Velocity execution and stored XSS, which can cascade into session hijacking or further compromise of page viewers. The additional bypass of extension-level event listeners (UserUpdatingDocumentEvent) is a secondary risk amplifier for organizations that rely on custom authorization logic in XWiki extensions. Even a mid-sized municipal IT team in malbork running a self-hosted XWiki instance should treat this as urgent given the broad affected version range covering installations from 13.4-rc-1 onward. No public exploit code exists and this is not listed in the CISA KEV catalog, so confirmed active exploitation is absent; however, the attack is conceptually simple - a single crafted API call - and requires no specialized tooling, meaning the exploit-to-complexity ratio favors attackers. EPSS data was not provided in the source intelligence.

An authenticated XWiki user with edit rights on a page sends a crafted PUT request to the Live Data REST API targeting the page's rights properties - for example, setting the levels field to include script. Because the API skips the checkSavingDocument() authorization check, the modification succeeds despite the user lacking script right through legitimate channels. The attacker then edits the page to insert a Velocity macro or raw JavaScript payload that executes in the browser of any user who subsequently views the page, enabling session theft or further privilege abuse.