GitHub Advisoryadvisory · Maven

GHSA-v7r8-8p5c-h4xw XWiki AdminTools application doesn't set permissions on the AdminTools space

MEDIUM Published 2025-11-18 Modified 2026-01-09 Official page ↗
Aliases
CVE-2025-54990
Ecosystem
Maven
Packages
com.xwiki.admintools:application-admintools
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2025-11-18

Affected packages

• Maven com.xwiki.admintools:application-admintools: < 1.1 → fixed in 1.1

Description

Impact Users without admin rights have access to `AdminTools.SpammedPages`. Details View rights are not restricted only to admin users for `AdminTools.SpammedPages`. While no data is visible to non admin users, the page is still accessible. Workarounds Set the view rights for the `AdminTools` space to be only available for the `XWikiAdminGroup`.

Related

Alias · CVE (1)

  • CVE-2025-54990 XWiki AdminTools integrates administrative tools for managing a running XWiki instance. vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References