CVE-2026-40104 json
XWiki's REST APIs can list all pages/spaces, leading to unavailability
published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also GHSA-mrqg-xmgm-rc5g , EUVD-2026-22817
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-oldcore 16.10.16, 17.4.8, 17.10.1
- maven org.xwiki.platform:xwiki-platform-legacy-oldcore 16.10.16, 17.4.8, 17.10.1
- xwiki xwiki 16.10.16, 17.4.8, 17.10.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-oldcore | >=1.8-rc-1, <16.10.16 >=17.0.0-rc-1, <17.4.8 >=17.5.0-rc-1, <17.10.1 |
16.10.16 17.4.8 17.10.1 |
| maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | >=1.8-rc-1, <16.10.16 >=17.0.0-rc-1, <17.4.8 >=17.5.0-rc-1, <17.10.1 |
16.10.16 17.4.8 17.10.1 |
Affected products
- xwiki org.xwiki.platform:xwiki-platform-oldcore
- xwiki org.xwiki.platform:xwiki-platform-legacy-oldcore
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7
web, patch
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g
web, vendor-advisory
-
jira.xwiki.org
/browse/XWIKI-23550
web, issue-tracking, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-40104
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2026-40104
- GitHub Advisory GHSA-mrqg-xmgm-rc5g
- NVD CVE-2026-40104
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.