medium5.3
CVE-2025-54990
XWiki AdminTools application doesn't set permissions on the AdminTools space
Impact
### Impact Users without admin rights have access to `AdminTools.SpammedPages`. ### Details View rights are not restricted only to admin users for `AdminTools.SpammedPages`. While no data is visible to non admin users, the page is still accessible. ### Workarounds Set the view rights for the `AdminTools` space to be only available for the `XWikiAdminGroup`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.xwiki.admintools:application-admintools | < 1.1 | 1.1 |