-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in the Velocity template code that processes enable/disable actions. The original code (before patch) only validated CSRF token and user existence, but didn't check: 1) If the requester has admin privileges ($hasAdmin), and 2) If the target user is the current user ($isCurrentUser). The commit diff shows these checks were added in the conditional statement that gates the enable/disable functionality. The file path is explicitly shown in the commit diff, and the CWE-862 (Missing Authorization) classification directly maps to these missing security checks in the template's control flow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-user-profile-ui | maven | >= 12.4, < 13.10.7 | 13.10.7 |
| org.xwiki.platform:xwiki-platform-user-profile-ui | maven | >= 14.0.0, < 14.4.2 | 14.4.2 |
JavaJavaOngoing coverage of React2Shell