CVE-2026-48048

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48048
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48048.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48048
Aliases
Published
2026-08-10T15:52:02.352Z
Modified
2026-08-12T04:17:53.858499123Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
Details

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page XWiki.LiveTableResultsMacros.

Database specific 
{
    "cwe_ids": [
        "CWE-359"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48048.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
86fedf2c46d0514ea65038cdcea3f75e3a36aab5
Introduced
445c0831fb8cf5610eda0eb58225890cb2bece6c
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
65a53ce90d27245391dec10056b066e7eb3ace7d
Fixed
a0c973343dbb009ef54643526df993676b0924e3
Fixed
6e30f885a30f60a418b4457335044b3724ec7f13
Fixed
c4442716b02ffcdaa9d5e703b1db6203e36456fa
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "6.2.1"
        },
        {
            "fixed": "16.10.17"
        },
        {
            "introduced": "17.0.0-rc-1"
        },
        {
            "fixed": "17.4.9"
        },
        {
            "introduced": "17.5.0-rc-1"
        },
        {
            "fixed": "17.10.3"
        }
    ]
}

Affected versions

xwiki-platform-16.*
xwiki-platform-16.10.0
xwiki-platform-16.10.0-rc-1
xwiki-platform-16.10.1
xwiki-platform-16.10.10
xwiki-platform-16.10.11
xwiki-platform-16.10.12
xwiki-platform-16.10.13
xwiki-platform-16.10.14
xwiki-platform-16.10.15
xwiki-platform-16.10.16
xwiki-platform-16.10.2
xwiki-platform-16.10.3
xwiki-platform-16.10.4
xwiki-platform-16.10.5
xwiki-platform-16.10.6
xwiki-platform-16.10.7
xwiki-platform-16.10.8
xwiki-platform-16.10.9
xwiki-platform-17.*
xwiki-platform-17.10.0
xwiki-platform-17.10.0-rc-1
xwiki-platform-17.10.1
xwiki-platform-17.10.2
xwiki-platform-17.4.0
xwiki-platform-17.4.0-rc-1
xwiki-platform-17.4.2
xwiki-platform-17.4.3
xwiki-platform-17.4.4
xwiki-platform-17.4.5
xwiki-platform-17.4.6
xwiki-platform-17.4.7
xwiki-platform-17.4.8
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48048.json"