Improper access control in XWiki platform - CVE-2025-49586
Published: May 5, 2026
Vulnerability identifier: #VU129882
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-49586
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in the App Within Minutes editor preview of XClass changes when editing an application. A remote user can edit an App Within Minutes application to execute arbitrary code.
Exploitation requires edit right on at least one App Within Minutes application.
Affected software
XWiki platform
How to mitigate CVE-2025-49586
Install security update from vendor's website.
XWiki platform - addressed in versions 16.4.7, 16.10.3, 17.0.0