CVE-2025-29925: XWiki allows unregistered users to access private pages information through REST endpoint
First published: Wed Mar 19 2025(Updated: )
XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XWiki Platform | <15.10.14<16.4.6<16.10.0-rc-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v
- https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
- https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206
- https://jira.xwiki.org/browse/XWIKI-22630
- https://jira.xwiki.org/browse/XWIKI-22639
Frequently Asked Questions
What is the severity of CVE-2025-29925?
CVE-2025-29925 has a high severity rating due to exposure of protected pages through REST endpoints.
How do I fix CVE-2025-29925?
To fix CVE-2025-29925, upgrade to XWiki Platform versions 15.10.14, 16.4.6, or 16.10.0-rc-1 or later.
What are the affected versions of XWiki Platform in CVE-2025-29925?
The affected versions are all prior to 15.10.14, 16.4.6, and 16.10.0-rc-1.
What type of vulnerability is CVE-2025-29925?
CVE-2025-29925 is a REST API exposure vulnerability affecting access to protected pages.
Can CVE-2025-29925 affect user privacy?
Yes, CVE-2025-29925 can potentially compromise user privacy by exposing protected content to unauthorized users.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/xwiki
- canonical/xwiki platform