CVE-2025-29926

The WikiManager REST API allows any user to create wikis

State: Published
Severity: 7.9 High
Published: Mar 19, 2025
Updated: Mar 19, 2025
Reserved: Mar 12, 2025

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.

Scores

CVSS	Score	Vector	Source
4.0	7.9 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H	GitHub_M

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
xwiki-platformxwiki	>= 5.4-rc-1, < 15.10.15Affected >= 16.0.0-rc-1, < 16.4.6Affected >= 16.5.0-rc-1, < 16.10.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.