CVE-2025-46554 XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

🗓️ 30 Apr 2025 18:27:53Reported by GitHub_MType

vulnrichment🔗 github.com👁 10 Views

CVE-2025-46554 allows unauthorized access to wiki attachments metadata via REST API in XWiki.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of the org.xwiki.platform:xwiki-platform-repository-rest-server component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows attackers to gain unauthorized access to protected information.	9 May 202500:00	–	bdu_fstec
Circl	CVE-2025-46554	30 Apr 202519:13	–	circl
CNNVD	XWiki Platform 安全漏洞	30 Apr 202500:00	–	cnnvd
CVE	CVE-2025-46554	30 Apr 202518:27	–	cve
Cvelist	CVE-2025-46554 XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API	30 Apr 202518:27	–	cvelist
EUVD	EUVD-2025-12749	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API	30 Apr 202516:49	–	github
Nuclei	XWiki REST API - Attachments Disclosure	4 Feb 202607:00	–	nuclei
NVD	CVE-2025-46554	30 Apr 202519:15	–	nvd
OpenVAS	XWiki 1.8.1 < 14.10.22, 15.0-rc-1 < 15.10.12, 16.0.0-rc-1 < 16.4.3, 16.5.0-rc-1 < 16.7.0 Improper Authorization Vulnerability (GHSA-r5cr-xm48-97xp)	18 Jul 202500:00	–	openvas

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5cr-xm48-97xp
jira	www.jira.xwiki.org/browse/XWIKI-22424
github	www.github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342
github	www.github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856
github	www.github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608

30 Apr 2025 18:27Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.3

EPSS0.01059

SSVC

cve identification xwiki vulnerability unauthorized access metadata exposure rest api threat security patch