CVE-2026-48048
Received Received - Intake

Information Disclosure in XWiki Platform

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-48048
EUVD
EUVD-2026-55658

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
xwiki xwiki_platform to 18.0.0RC1 (exc)
xwiki xwiki_platform 18.0.0RC1
xwiki xwiki_platform 17.10.13
xwiki xwiki_platform 17.4.9
xwiki xwiki_platform 16.10.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects XWiki Platform versions before 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17. It allows attackers to retrieve user password hashes by sending 768 specially crafted requests to the LiveTableResults endpoint. The issue stems from an insufficient patch for a previous vulnerability (GHSA-5cf8-vrr8-8hjm), enabling bit-by-bit extraction of password salts and hashes.

Detection Guidance

This vulnerability can be detected by checking the XWiki version against affected releases. Use commands like 'xwiki --version' or check the version in the web interface. If your version is between 6.2.1 and prior to 18.0.0RC1, 17.10.13, 17.4.9, or 16.10.17, it is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to user accounts by revealing password hashes. Attackers could use these hashes to perform offline brute-force attacks, potentially gaining control of accounts with weak or reused passwords. This compromises data confidentiality and user privacy.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to personal data (password hashes). GDPR mandates protection of personal data, while HIPAA requires safeguarding electronic protected health information. Exploitation could lead to data breaches, triggering mandatory breach notifications and potential fines.

Mitigation Strategies

Upgrade XWiki to version 18.0.0RC1, 17.10.13, 17.4.9, or 16.10.17 or later. Alternatively, manually apply the patch to the wiki page 'XWiki.LiveTableResultsMacros' as a temporary fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart