cveboard RSS feed

CVE-2026-40104

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

XWiki's REST APIs can list all pages/spaces, leading to unavailability

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

org.xwiki.platform:xwiki-platform-oldcore

Vendor
xwiki
Product
org.xwiki.platform:xwiki-platform-oldcore
Platforms
Unknown
Default status
Unknown
org.xwiki.platform:xwiki-platform-oldcore · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 1.8-rc-1, < 16.10.16affectedUnavailableUnavailableUnavailableNone listed
>= 17.0.0-rc-1, < 17.4.8affectedUnavailableUnavailableUnavailableNone listed
>= 17.5.0-rc-1, < 17.10.1affectedUnavailableUnavailableUnavailableNone listed

org.xwiki.platform:xwiki-platform-legacy-oldcore

Vendor
xwiki
Product
org.xwiki.platform:xwiki-platform-legacy-oldcore
Platforms
Unknown
Default status
Unknown
org.xwiki.platform:xwiki-platform-legacy-oldcore · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 1.8-rc-1, < 16.10.16affectedUnavailableUnavailableUnavailableNone listed
>= 17.0.0-rc-1, < 17.4.8affectedUnavailableUnavailableUnavailableNone listed
>= 17.5.0-rc-1, < 17.10.1affectedUnavailableUnavailableUnavailableNone listed