Exposure of Private Information ('Privacy Violation') in XWiki platform - CVE-2025-54124
Published: May 5, 2026
Vulnerability identifier: #VU129888
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-54124
CWE-ID: CWE-359
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in database list properties when referencing password properties. A remote user can create an XClass with a database list property that references a password property and add an object of that XClass to disclose sensitive information.
In practice, with a standard rights setup, any user with an account on the wiki can access password hashes of all users, and possibly other password properties on pages that the user can view.
Affected software
XWiki platform
How to mitigate CVE-2025-54124
Install security update from vendor's website.
XWiki platform - addressed in versions 16.4.7, 16.10.5, 17.2.0