medium5.3

CVE-2025-46554

XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Impact

### Impact Anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It's not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki. To reproduce: * remove view from guest on the whole wiki * logout * access http://127.0.0.1:8080/xwiki/rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments You get a list of attachments, while the expected result should be an empty list. ### Patches This vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3. ### Workarounds We're not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/XWIKI-22424 * https://jira.xwiki.org/browse/XWIKI-22427 * https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342#diff-0 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org) ### Attribution Issue reported by [Lukas Monert](https://github.com/LMonert).

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.xwiki.platform:xwiki-platform-rest-server`	>= 1.8.1, < 14.10.22	14.10.22

Affected products

Vendor	Product	Affected versions
Xwiki	Xwiki	from 1.8.1 before 14.10.22 from 15.0 before 15.10.12 from 16.0.0 before 16.4.3 from 16.5.0 before 16.7.0

Weakness classification

CWE-862