5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46554

CVE-2025-46554: XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Impact

Anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It's not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki.

To reproduce:

remove view from guest on the whole wiki
logout
access http://127.0.0.1:8080/xwiki/rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments

You get a list of attachments, while the expected result should be an empty list.

Patches

This vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3.

Workarounds

We're not aware of any workaround except upgrading.

References

https://jira.xwiki.org/browse/XWIKI-22424
https://jira.xwiki.org/browse/XWIKI-22427
https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342#diff-0

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

Issue reported by Lukas Monert.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-46554

CVE-2025-46554:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 1.8.1, < 14.10.22	14.10.22
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 15.0-rc-1, < 15.10.12	15.10.12
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 16.0.0-rc-1, < 16.4.3	16.4.3
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 16.5.0-rc-1, < 16.7.0	16.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a missing authorization check when listing attachments via REST API endpoints. The primary commit 'a43e933ddeda17dad1772396e1757998260e9342' shows that the getAttachments method in org.xwiki.rest.internal.resources.BaseAttachmentsResource was modified to add an explicit authorization check (.filter(a -> authorization.hasAccess(Right.VIEW, a.getReference()))). This indicates that, prior to this patch, this method did not correctly filter attachments based on user rights, which is the core of the vulnerability.

The getAttachments methods in the concrete resource implementation classes (AttachmentsResourceImpl, SpaceAttachmentsResourceImpl, and WikiAttachmentsResourceImpl) are the public-facing REST API handlers. These methods call super.getAttachments(...), which refers to the method in BaseAttachmentsResource. Therefore, these subclass methods were vulnerable because they utilized the flawed BaseAttachmentsResource.getAttachments method. The patch to the base class effectively remediated the vulnerability for all these public endpoints. These functions would appear in a runtime profile when the vulnerability is triggered, as they are part of the call chain processing the request and returning the unfiltered attachment list.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-46554: XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Impact

Patches

Workarounds

References

For more information

Attribution

CVE-2025-46554:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

5.3

5.3

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-46554: XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Impact

Patches

Workarounds

References

For more information

Attribution

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI