CVE-2026-53966

XWiki Platform's Live Data edit REST API skips the authorization checks that normally run when a document is saved, so any user who can edit a page can change that page's rights without proper approval. An attacker with basic edit permissions can use this to grant script right to a page and then execute powerful Velocity scripts or push unfiltered HTML/JavaScript to wiki visitors, effectively turning a low-privileged editor into a near-administrative attacker (CWE-862, CVSS 4.0 7.1 high). The same missing checks can bypass extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. All XWiki Platform deployments from 13.4-rc-1 up to the fix versions are affected. No public proof of concept is known and there is no evidence of in-the-wild exploitation.

What to do: Upgrade to XWiki Platform 16.10.17, 17.4.10, 17.10.4, or 18.1.0-rc-1 (or later). Until patched, tighten edit permissions so only trusted users can modify pages, and audit page rights and script-right grants for unexpected changes made via the Live Data REST API. Also review Velocity/HTML content recently added by low-privileged editors and verify that security extensions relying on document-save listeners (e.g., UserUpdatingDocumentEvent) have not been bypassed.