8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49584

CVE-2025-49584: XWiki makes title of inaccessible pages available through the class property values REST API

Impact

The title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high.

Patches

This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page.

Workarounds

We're not aware of any workarounds.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49584

CVE-2025-49584:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 10.9, < 16.4.7	16.4.7
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 16.5.0-rc-1, < 16.10.3	16.10.3
org.xwiki.platform:xwiki-platform-rest-server	maven	>= 17.0.0-rc-1, < 17.0.0	17.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to retrieve titles of inaccessible pages through the REST API. The provided commit (ee642f973a7c95d2d146fe03c81bcdee1871f4ec) patches this by adding explicit access control checks (this.contextualAuthorizationManager.hasAccess(Right.VIEW, ...)). The vulnerable functions are those that, prior to this patch, would fetch and return page/document titles or related metadata (like icons which might imply existence or type) without performing these checks.

The primary vulnerable functions are getLabel in GroupsClassPropertyValuesProvider and PageClassPropertyValuesProvider, as these methods are directly responsible for retrieving and returning the display title of documents. The getValue method in AbstractDocumentListClassPropertyValuesProvider is also implicated as it's a more generic method that could be used by subclasses to expose titles if they didn't implement their own checks. The getIcon methods in GroupsClassPropertyValuesProvider and UsersClassPropertyValuesProvider were also modified to add checks, indicating they could previously leak information about inaccessible documents by attempting to fetch their icons/avatars.

The root cause is the missing authorization check before accessing and returning document titles or related data via specific REST API endpoints that utilize these property value providers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.