Vulnerability · Published Apr 15, 2026 · Assigned by GitHub_M
CVE-2026-40104XWiki's REST APIs can list all pages/spaces, leading to unavailability
High 8.2
In plain English
A high-severity resource allocation without limits in org.xwiki.platform:xwiki-platform-legacy-oldcore from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | 16.10.16 | GHSA-mrqg-xmgm-rc5g |
| Maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | 17.4.8 | GHSA-mrqg-xmgm-rc5g |
| Maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | 17.10.1 | GHSA-mrqg-xmgm-rc5g |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 16.10.16 | GHSA-mrqg-xmgm-rc5g |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 17.4.8 | GHSA-mrqg-xmgm-rc5g |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 17.10.1 | GHSA-mrqg-xmgm-rc5g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | org.xwiki.platform:xwiki-platform-oldcore | >= 1.8-rc-1, < 16.10.16>= 17.0.0-rc-1, < 17.4.8>= 17.5.0-rc-1, < 17.10.1 |
| xwiki | org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 1.8-rc-1, < 16.10.16>= 17.0.0-rc-1, < 17.4.8>= 17.5.0-rc-1, < 17.10.1 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-23550 x_refsource_MISC