Vulnerability · Published Nov 18, 2025 · Assigned by GitHub_M
CVE-2025-54990XWiki AdminTools application doesn't set permissions on the AdminTools space
Medium 5.3
In plain English
A medium-severity incorrect default permissions in application-admintools from xwikisas. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users without admin rights have access to AdminTools.SpammedPages. View rights are not restricted only to admin users for AdminTools.SpammedPages. While no data is visible to non admin users, the page is still accessible. This issue has been patched in version 1.1. A workaround involves setting the view rights for the AdminTools space to be only available for the XWikiAdminGroup.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.xwiki.admintools:application-admintools | 1.1 | GHSA-v7r8-8p5c-h4xw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwikisas | application-admintools | < 1.1 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N