CVE-2026-53966

Published Sep 15, 2026 Modified Sep 15, 2026 CWE-862

Description

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

Is your site exposed to CVE-2026-53966?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-862 Missing Authorization

References

Other References

https://github.com/xwiki/xwiki-platform/commit/1ddb954767e50782be960b953b012c1242f6843b https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626 https://github.com/xwiki/xwiki-platform/commit/778b82b4806ce7ebddb775f953545ff73b841f8b https://github.com/xwiki/xwiki-platform/commit/fbad7dac8f46c560577e41b9259cbbbbd343e6fc https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.17 https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.4 https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.10 https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.1.0-rc-1 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw https://jira.xwiki.org/browse/XWIKI-23986

Frequently Asked Questions

What is CVE-2026-53966? +
XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script right and then execute potentially dangerous Velocity scripts or send unfiltered HTML and JavaScript to clients. The same missing checks can circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. This issue is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.
How do I check if I'm vulnerable to CVE-2026-53966? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40570

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` …
CVE-2026-42317

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and …
CVE-2026-4881

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make …
CVE-2026-40543

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives …
CVE-2026-10831

A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does …
CVE-2026-40314

NamelessMC is website software for Minecraft servers. In version 2.2.4,`core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2026-53966 — free, no signup required.