GitHub Advisoryadvisory · Maven

GHSA-mrqg-xmgm-rc5g XWiki's REST APIs can list all pages/spaces, leading to unavailability

MEDIUM Published 2026-04-14 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-40104
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-legacy-oldcore
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-04-14

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 1.8-rc-1, < 16.10.16 → fixed in 16.10.16 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 17.0.0-rc-1, < 17.4.8 → fixed in 17.4.8 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 17.5.0-rc-1, < 17.10.1 → fixed in 17.10.1 • Maven org.xwiki.platform:xwiki-platform-legacy-oldcore: >= 1.8-rc-1, < 16.10.16 → fixed in 16.10.16 • Maven org.xwiki.platform:xwiki-platform-legacy-oldcore: >= 17.0.0-rc-1, < 17.4.8 → fixed in 17.4.8 • Maven org.xwiki.platform:xwiki-platform-legacy-oldcore: >= 17.5.0-rc-1, < 17.10.1 → fixed in 17.10.1

Description

Impact REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis. Patches This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1. Workarounds We're not aware of any workarounds apart from upgrading the affected modules.

Related

Alias · CVE (1)

  • CVE-2026-40104 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References