CVE-2026-53966

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53966
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53966.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53966
Aliases
Published
2026-09-15T14:38:27Z
Modified
2026-09-17T08:15:52Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Platform: Privilege escalation from edit to script right through Live Data editing
Details

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53966.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
07646caefe448f6829c3531390738f73917575b9
Introduced
445c0831fb8cf5610eda0eb58225890cb2bece6c
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
d611720cbb5e818a686a98a452b4bead37798b24
Fixed
65a53ce90d27245391dec10056b066e7eb3ace7d
Fixed
c44055651aedc687eaeb6200ae856fc16cd16a12
Fixed
60961bd3ece1c0a3e7a81ecd9274e6010710afe4
Fixed
810792740bea0e5efe5f507a4ab166cf7f75aa91
Fixed
1ddb954767e50782be960b953b012c1242f6843b
Fixed
448b0f074cc6711410eb2647c4740454c92d1626
Fixed
778b82b4806ce7ebddb775f953545ff73b841f8b
Fixed
fbad7dac8f46c560577e41b9259cbbbbd343e6fc
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "13.4-rc-1"
        },
        {
            "fixed": "16.10.17"
        },
        {
            "introduced": "17.0.0-rc-1"
        },
        {
            "fixed": "17.4.10"
        },
        {
            "introduced": "17.5.0-rc-1"
        },
        {
            "fixed": "17.10.4"
        },
        {
            "introduced": "18.0.0-rc-1"
        },
        {
            "fixed": "18.1.0-rc-1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

xwiki-platform-16.*
xwiki-platform-16.10.0
xwiki-platform-16.10.0-rc-1
xwiki-platform-16.10.1
xwiki-platform-16.10.10
xwiki-platform-16.10.11
xwiki-platform-16.10.12
xwiki-platform-16.10.13
xwiki-platform-16.10.14
xwiki-platform-16.10.15
xwiki-platform-16.10.16
xwiki-platform-16.10.2
xwiki-platform-16.10.3
xwiki-platform-16.10.4
xwiki-platform-16.10.5
xwiki-platform-16.10.6
xwiki-platform-16.10.7
xwiki-platform-16.10.8
xwiki-platform-16.10.9
xwiki-platform-17.*
xwiki-platform-17.10.0
xwiki-platform-17.10.0-rc-1
xwiki-platform-17.10.1
xwiki-platform-17.10.2
xwiki-platform-17.10.3
xwiki-platform-17.4.0
xwiki-platform-17.4.0-rc-1
xwiki-platform-17.4.2
xwiki-platform-17.4.3
xwiki-platform-17.4.4
xwiki-platform-17.4.5
xwiki-platform-17.4.6
xwiki-platform-17.4.7
xwiki-platform-17.4.8
xwiki-platform-17.4.9
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53966.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "114346911926228381040780204984258480196",
                "86206747340387745012914868781944161560",
                "84295902335084895616291359403851655141",
                "177806175072845315484815130947211537249"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-17ab8670",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "114346911926228381040780204984258480196",
                "95021337872712337700028204232553764777",
                "218864058979699187501481290096087755394",
                "177806175072845315484815130947211537249"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-19ee96e4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "298104980517665613254233095935305955500",
            "length": 411
        },
        "id": "CVE-2026-53966-5e81ea61",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function": "saveDocument"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "298104980517665613254233095935305955500",
            "length": 411
        },
        "id": "CVE-2026-53966-5fbde3a7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function": "saveDocument"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-60dc630e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "298104980517665613254233095935305955500",
            "length": 411
        },
        "id": "CVE-2026-53966-ad2031b3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function": "saveDocument"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-bd29b28f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "298104980517665613254233095935305955500",
            "length": 411
        },
        "id": "CVE-2026-53966-c07ba6ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function": "saveDocument"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-cbba7cef",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "278975659446423268934496687331230662637",
                "95021337872712337700028204232553764777",
                "218864058979699187501481290096087755394",
                "177806175072845315484815130947211537249"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-e3b49a40",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-e5e3d8c5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "114346911926228381040780204984258480196",
                "95021337872712337700028204232553764777",
                "218864058979699187501481290096087755394",
                "177806175072845315484815130947211537249"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53966-f7bdc697",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:15:52Z"