GHSA-mrqg-xmgm-rc5g

Source

https://github.com/advisories/GHSA-mrqg-xmgm-rc5g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mrqg-xmgm-rc5g

Aliases

CVE-2026-40104

Published

2026-04-14T22:34:04Z

Modified

2026-05-05T16:13:01Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details

Impact

REST API endpoints like /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

Patches

This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

Workarounds

We're not aware of any workarounds apart from upgrading the affected modules.

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-14T22:34:04Z",
    "nvd_published_at":  "2026-04-15T04:17:47Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.8-rc-1

Fixed

16.10.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json"

org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0-rc-1

Fixed

17.4.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json"

org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.5.0-rc-1

Fixed

17.10.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json"

org.xwiki.platform:xwiki-platform-legacy-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-legacy-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-legacy-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.8-rc-1

Fixed

16.10.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json"

org.xwiki.platform:xwiki-platform-legacy-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-legacy-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-legacy-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0-rc-1

Fixed

17.4.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json"

org.xwiki.platform:xwiki-platform-legacy-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-legacy-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-legacy-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.5.0-rc-1

Fixed

17.10.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mrqg-xmgm-rc5g/GHSA-mrqg-xmgm-rc5g.json"