Xwiki-Platform-Livedata-Livetable - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xwiki-platform-livedata-livetable/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 19 Aug 2026 22:33:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in XWiki Platform via Live Data REST APIhttps://feed.craftedsignal.io/briefs/2026-08-xwiki-privilege-escalation/Wed, 19 Aug 2026 22:33:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-xwiki-privilege-escalation/A privilege escalation vulnerability in the XWiki Platform Live Data Live Table component allows users with page edit rights to acquire script rights through manipulated REST API requests.XWiki Platform is affected by a security flaw (CVE-2026-53966) residing in the Live Data Live Table component. The vulnerability permits an authenticated user with standard edit permissions on a document to escalate their privileges to script rights via the Live Data edit REST API. By manipulating requests to this API, a user can modify document rights directly, effectively bypassing built-in security checks and existing access control listeners associated with document update events.

Obtaining script rights is a high-severity outcome as it enables the execution of arbitrary Velocity scripts and the injection of unauthorized HTML or JavaScript content into the victim's session. This capability allows for further exploitation of the application or client-side attacks against other users. The issue impacts multiple versions of the xwiki-platform-livedata-livetable package, including versions ranging from 13.4-rc-1 through 18.1.0-rc-1. The vendor has addressed the vulnerability in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0.

Impact

Successful exploitation allows a low-privileged user to gain unauthorized script execution capabilities within the XWiki environment. This escalation circumvents security checks implemented in extensions that rely on UserUpdatingDocumentEvent listeners. Potential consequences include unauthorized code execution on the server via Velocity scripts, cross-site scripting (XSS) via injected content, and the ability to modify critical document permissions, which can be leveraged to compromise the integrity and confidentiality of the entire wiki instance.

Recommendation

Prioritize the upgrade of the XWiki platform to the patched versions specified in the security advisory.

  • Upgrade the xwiki-platform-livedata-livetable package to version 16.10.17, 17.4.10, 17.10.4, or 18.1.0 as appropriate for your branch to address CVE-2026-53966.
  • Audit logs for suspicious activity involving the Live Data REST API, specifically monitoring for frequent modifications to document rights originating from accounts with limited privileges.
  • Review all custom security listeners or extensions currently deployed in the XWiki instance to verify if they rely on standard document update events that might be bypassed by this vulnerability.
]]>highadvisory