CVE-2026-40104

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40104
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40104.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40104
Aliases
Published
2026-04-15T00:01:58.583Z
Modified
2026-07-15T01:49:21.443315977Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki's REST APIs can list all pages/spaces, leading to unavailability
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40104.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
10aac24eea2647c0e044176c369755baf8c5a5f1
Fixed
f5d882bc97f326e1a4847aace42c60fe7cba0f41
Introduced
e84d9bd1b4c0c8219597e10acfd8fbd692416294
Fixed
7ea92428b2dcec895366796ea6d211c01044257f
Introduced
0f12307c8803e5abd5fe7016bd0adf0850c5f903
Fixed
7b786a82160aed48172815cc1b7a66d46f7e5cc9
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.8"
        },
        {
            "fixed": "16.10.16"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.8"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.1"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
943ce46958cb17adcf82e8fa381fb36616646f0b
Fixed
12682112b51aa67f5acafa5398193b69adf229f7
Introduced
7edb5b7d98170ec081c7e30237971d7dfb8a4401
Fixed
617c215853ac7649119d019d085e739f5b2b89a8
Introduced
b85d21efede0f7c07c04c5ad5fb7610be0866096
Fixed
a44c0b52377470cd7b597f0e920cfbc85cf043e1
Fixed
47b568c4753a6e682b14be1ca581bdd3b25d45a7
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.8"
        },
        {
            "fixed": "16.10.16"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.8"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40104.json"