CVE-2025-29925: XWiki allows unregistered users to access private pages information through REST endpoint
Impact
Protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki (actually it only impacts the main wiki due to XWIKI-22639).
Patches
The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
Workarounds
There's no workaround except upgrading or applying manually the changes of the commits (see references) in xwiki-platform-rest-server and recompiling / rebuilding it.
References
Original JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22630 Related JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22639 Commits of the patch: https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 and https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-rest-serverto a version that resolves this vulnerability.Fixed in 16.10.0-rc-1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-rest-serverto a version that resolves this vulnerability.Fixed in 16.4.6 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-rest-serverto a version that resolves this vulnerability.Fixed in 15.10.14 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 15.10.14 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 16.4.6 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 16.10.0RC1 - Compensating control
As a workaround if you cannot upgrade, manually apply the changes from the referenced commits in `xwiki-platform-rest-server`, then recompile/rebuild it (to prevent protected pages from being listed by the REST endpoints `/rest/wikis/[wikiName]/pages` when the user lacks view rights).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29925?
CVE-2025-29925 has a high severity rating due to exposure of protected pages through REST endpoints.
How do I fix CVE-2025-29925?
To fix CVE-2025-29925, upgrade to XWiki Platform versions 15.10.14, 16.4.6, or 16.10.0-rc-1 or later.
What are the affected versions of XWiki Platform in CVE-2025-29925?
The affected versions are all prior to 15.10.14, 16.4.6, and 16.10.0-rc-1.
What type of vulnerability is CVE-2025-29925?
CVE-2025-29925 is a REST API exposure vulnerability affecting access to protected pages.
Can CVE-2025-29925 affect user privacy?
Yes, CVE-2025-29925 can potentially compromise user privacy by exposing protected content to unauthorized users.