CVE-2025-48063 XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right

🗓️ 21 May 2025 17:38:37Reported by GitHub_MType

XWiki vulnerability allows edit users to set programming rights, risking remote code execution.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the org.xwiki.platform:xwiki-platform-security-authorization-bridge package in the XWiki Platform, a platform for creating collaborative web applications, allows a perpetrator to execute arbitrary code.	4 Jun 202500:00	–	bdu_fstec
Circl	CVE-2025-48063	21 May 202521:52	–	circl
CNNVD	XWiki Platform 安全漏洞	21 May 202500:00	–	cnnvd
CVE	CVE-2025-48063	21 May 202517:38	–	cve
EUVD	EUVD-2025-16054	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right	21 May 202518:26	–	github
NVD	CVE-2025-48063	21 May 202518:15	–	nvd
OpenVAS	XWiki 16.10.0-rc-1 < 16.10.4, 17.0.0-rc-1 < 17.1.0 RCE Vulnerability (GHSA-rhfv-688c-p6hp)	18 Jul 202500:00	–	openvas
OSV	CVE-2025-48063 XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right	21 May 202517:38	–	osv
OSV	GHSA-RHFV-688C-P6HP XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right	21 May 202518:26	–	osv

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 16.10.0-rc-1, < 16.10.4",
        "status": "affected"
      },
      {
        "version": ">= 17.0.0-rc-1, < 17.1.0-rc-1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-22859
github	www.github.com/xwiki/xwiki-platform/commit/2557813aef3b863988d6cca58de996e207086898
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-rhfv-688c-p6hp

21 May 2025 17:38Current

CVSS 44.8

EPSS0.04877

CWE-285

xwiki vulnerability edit rights remote code execution required rights programming rights security flaws