CVE-2025-49586

HIGH

Xwiki < 16.4.7 - Incorrect Authorization

Title source: rule

Description

XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.

References (3)

Scores

CVSS v3 8.8
EPSS 0.0455
EPSS Percentile 89.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-863
Status published

Affected Products (5)

xwiki/xwiki < 16.4.7
xwiki/xwiki
xwiki/xwiki
xwiki/xwiki
org.xwiki.platform/xwiki-platform-oldcore < 16.4.7Maven

Timeline

Published Jun 13, 2025
Tracked Since Feb 18, 2026