Missing Authorization in XWiki platform - CVE-2024-55876
Published: December 12, 2024 / Updated: April 9, 2026
Vulnerability identifier: #VU125595
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-55876
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform scheduling operations on subwikis for any main wiki user.
The vulnerability exists due to improper access control in Scheduler.WebHome when handling scheduling operation requests in a subwiki. A remote user can trigger job operations to perform scheduling operations on subwikis for any main wiki user.
Only subwikis with the job scheduler enabled are vulnerable.
Affected software
XWiki platform
How to mitigate CVE-2024-55876
Install security update from vendor's website.
XWiki platform - addressed in versions 15.10.9, 16.3.0