CVE-2026-53966

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53966
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53966.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53966
Aliases
Published
2026-09-15T14:38:27Z
Modified
2026-10-28T11:17:01Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Platform: Privilege escalation from edit to script right through Live Data editing
Details

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53966.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
07646caefe448f6829c3531390738f73917575b9
Fixed
65a53ce90d27245391dec10056b066e7eb3ace7d
Introduced
445c0831fb8cf5610eda0eb58225890cb2bece6c
Fixed
c44055651aedc687eaeb6200ae856fc16cd16a12
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
60961bd3ece1c0a3e7a81ecd9274e6010710afe4
Introduced
d611720cbb5e818a686a98a452b4bead37798b24
Fixed
810792740bea0e5efe5f507a4ab166cf7f75aa91
Fixed
1ddb954767e50782be960b953b012c1242f6843b
Fixed
448b0f074cc6711410eb2647c4740454c92d1626
Fixed
778b82b4806ce7ebddb775f953545ff73b841f8b
Fixed
fbad7dac8f46c560577e41b9259cbbbbd343e6fc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "13.4-rc-1"
                },
                {
                    "fixed":  "16.10.17"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "17.0.0-rc-1"
                },
                {
                    "fixed":  "17.4.10"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "17.5.0-rc-1"
                },
                {
                    "fixed":  "17.10.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "18.0.0-rc-1"
                },
                {
                    "fixed":  "18.1.0-rc-1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "1ddb954767e50782be960b953b012c1242f6843b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "448b0f074cc6711410eb2647c4740454c92d1626"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "778b82b4806ce7ebddb775f953545ff73b841f8b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "fbad7dac8f46c560577e41b9259cbbbbd343e6fc"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "xwiki-platform-16.10.17",
            "range":  [
                {
                    "fixed":  "65a53ce90d27245391dec10056b066e7eb3ace7d"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "xwiki-platform-17.10.4",
            "range":  [
                {
                    "fixed":  "60961bd3ece1c0a3e7a81ecd9274e6010710afe4"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "xwiki-platform-17.4.10",
            "range":  [
                {
                    "fixed":  "c44055651aedc687eaeb6200ae856fc16cd16a12"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "xwiki-platform-18.1.0-rc-1",
            "range":  [
                {
                    "fixed":  "810792740bea0e5efe5f507a4ab166cf7f75aa91"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

xwiki-platform-16.*
xwiki-platform-16.10.0
xwiki-platform-16.10.0-rc-1
xwiki-platform-16.10.1
xwiki-platform-16.10.10
xwiki-platform-16.10.11
xwiki-platform-16.10.12
xwiki-platform-16.10.13
xwiki-platform-16.10.14
xwiki-platform-16.10.15
xwiki-platform-16.10.16
xwiki-platform-16.10.2
xwiki-platform-16.10.3
xwiki-platform-16.10.4
xwiki-platform-16.10.5
xwiki-platform-16.10.6
xwiki-platform-16.10.7
xwiki-platform-16.10.8
xwiki-platform-16.10.9
xwiki-platform-17.*
xwiki-platform-17.10.0
xwiki-platform-17.10.0-rc-1
xwiki-platform-17.10.1
xwiki-platform-17.10.2
xwiki-platform-17.10.3
xwiki-platform-17.4.0
xwiki-platform-17.4.0-rc-1
xwiki-platform-17.4.2
xwiki-platform-17.4.3
xwiki-platform-17.4.4
xwiki-platform-17.4.5
xwiki-platform-17.4.6
xwiki-platform-17.4.7
xwiki-platform-17.4.8
xwiki-platform-17.4.9
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53966.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "114346911926228381040780204984258480196",
                "86206747340387745012914868781944161560",
                "84295902335084895616291359403851655141",
                "177806175072845315484815130947211537249"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-17ab8670",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "114346911926228381040780204984258480196",
                "95021337872712337700028204232553764777",
                "218864058979699187501481290096087755394",
                "177806175072845315484815130947211537249"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-19ee96e4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "298104980517665613254233095935305955500",
            "length":  411
        },
        "id":  "CVE-2026-53966-5e81ea61",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function":  "saveDocument"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "298104980517665613254233095935305955500",
            "length":  411
        },
        "id":  "CVE-2026-53966-5fbde3a7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function":  "saveDocument"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-60dc630e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "298104980517665613254233095935305955500",
            "length":  411
        },
        "id":  "CVE-2026-53966-ad2031b3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function":  "saveDocument"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-bd29b28f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "298104980517665613254233095935305955500",
            "length":  411
        },
        "id":  "CVE-2026-53966-c07ba6ce",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java",
            "function":  "saveDocument"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-cbba7cef",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "278975659446423268934496687331230662637",
                "95021337872712337700028204232553764777",
                "218864058979699187501481290096087755394",
                "177806175072845315484815130947211537249"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-e3b49a40",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "265060893634517947493736348678584193098",
                "9311775388739615078628715465538329831",
                "111774033204644714621080296897763883894",
                "261546235032639101256567152223195391958",
                "104133916145374161269223723403815916000",
                "157399203860470264657284365131912915596",
                "138185174868546065612909792517492746918",
                "167196614638126957193652377100729081088",
                "289715463591362483523047438812346799017",
                "330199461533783417334877874666310488240",
                "14833168821429309736908247243595525207",
                "261378265455354132351889373767386967376"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-e5e3d8c5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-livetable/src/main/java/org/xwiki/livedata/internal/livetable/ModelBridge.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "180128877075522935338584011081460716719",
                "136119525039823851172270236271193614549",
                "150559132699603800691417821774067647195",
                "114346911926228381040780204984258480196",
                "95021337872712337700028204232553764777",
                "218864058979699187501481290096087755394",
                "177806175072845315484815130947211537249"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53966-f7bdc697",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-test/xwiki-platform-livedata-test-docker/src/test/it/org/xwiki/livedata/test/ui/LiveDataIT.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:17:01Z"