XWiki's REST APIs can list all pages/spaces, leading to unavailability

GHSA-mrqg-xmgm-rc5g · CVE-2026-40104

Published Apr 14, 2026 · Modified May 5, 2026

Description

Impact

REST API endpoints like /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

Patches

This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

Workarounds

We're not aware of any workarounds apart from upgrading the affected modules.

References

WEB https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-40104
WEB https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7
PACKAGE https://github.com/xwiki/xwiki-platform
WEB https://jira.xwiki.org/browse/XWIKI-23550

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes