Incorrect Use of Privileged APIs in XWiki platform - CVE-2023-29507
Published: April 12, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129978
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-29507
CWE-ID: CWE-648
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to incorrect use of privileged APIs in the Document script API when returning a DocumentAuthors object to scripts. A remote privileged user can set arbitrary document authors to escalate privileges.
This can lead to subsequent script executions being evaluated with the modified author for rights checking.
Affected software
XWiki platform
How to mitigate CVE-2023-29507
Install security update from vendor's website.
XWiki platform - addressed in versions 14.4.7, 14.10