CVE-2026-53966
Received Received - Intake

Privilege Escalation in XWiki Platform via Live Data API

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-53966
EUVD
EUVD-2026-78592

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
xwiki xwiki_platform From 13.4-rc-1 (inc) to 16.10.17 (inc)
xwiki xwiki_platform 16.10.17
xwiki xwiki_platform 17.4.10
xwiki xwiki_platform 17.10.4
xwiki xwiki_platform 18.1.0-rc-1
xwiki xwiki_platform From 13.4-rc-1 (inc) to 16.10.17 (exc)
xwiki xwiki_platform From 17.0.0-rc-1 (inc) to 17.4.10 (exc)
xwiki xwiki_platform From 17.5.0-rc-1 (inc) to 17.10.4 (exc)
xwiki xwiki_platform From 18.0.0-rc-1 (inc) to 18.1.0-rc-1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53966 is a privilege escalation vulnerability in XWiki Platform. It allows users with edit permissions on a page to exploit the Live Data editing REST API to modify page rights without proper authorization checks. This grants them script execution rights, enabling execution of harmful Velocity scripts or transmission of unfiltered HTML and JavaScript to clients. The vulnerability also bypasses security controls implemented as listeners for user document events.

Detection Guidance

Detecting this vulnerability requires checking if your XWiki instance is running a vulnerable version (13.4-rc-1 to 16.10.16, 17.0.0-rc-1 to 17.4.9, 17.5.0-rc-1 to 17.10.3, or 18.0.0-rc-1 to 18.0.9). Review logs for unauthorized script executions or Live Data API modifications. Check for users granted script rights without proper authorization.

Impact Analysis

An attacker with edit permissions could escalate privileges to execute arbitrary scripts or inject malicious code. This could lead to data theft, unauthorized modifications, or disruption of services. The impact includes potential compromise of sensitive data, system integrity, and client-side security if unfiltered scripts are delivered to users.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR and HIPAA requirements for data protection and access controls. Compliance failures may result in legal penalties, reputational damage, and loss of trust due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade XWiki to a patched version: 16.10.17, 17.4.10, 17.10.4, or 18.1.0-rc-1 or later. No other workarounds are known.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart