Missing Authorization in XWiki platform - CVE-2025-23025
Published: January 14, 2025 / Updated: April 9, 2026
Vulnerability identifier: #VU125588
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-23025
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper access control in the realtime WYSIWYG editor when handling realtime editing sessions involving users with script or programming rights. A remote user can insert a script rendering macro into edited content to escalate privileges.
User interaction is required, and exploitation depends on another participant in the same realtime editing session having script or programming rights.
Affected software
XWiki platform
How to mitigate CVE-2025-23025
Install security update from vendor's website.
XWiki platform - addressed in versions 15.10.12, 16.4.1