{"id":"CVE-2021-32620","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.","aliases":["GHSA-76mp-659p-rw65"],"modified":"2026-08-07T16:57:22.465832Z","published":"2021-05-28T21:15:08.937Z","references":[{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65"},{"type":"REPORT","url":"https://jira.xwiki.org/browse/XWIKI-17942"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"f15d9b0cb5a00e3e5be7086439228a642077090d"},{"fixed":"04b39a6071d54116a2843cbc4dfd82df1d205000"},{"introduced":"0cfc1b3397ce969321409dfc47730c703c330305"},{"fixed":"eb0223af7c2f08c62fbe1b381b12b465d6f4f39e"},{"introduced":"bf36e69ee28dd996e846d5ab9b131712b643bb4e"},{"fixed":"afc3a117997a7a10595deb42279020817d7e8df8"},{"introduced":"7ea75e4945d00f7321824e1442b8922da2f2fc4b"},{"fixed":"271203deeb757a7c21e3c0623b79e7b3050c2a05"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"11.6"},{"fixed":"11.10.13"},{"introduced":"12.0"},{"fixed":"12.6.7"},{"introduced":"12.7"},{"fixed":"12.10.2"},{"introduced":"12.10.3"},{"fixed":"13.0"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32620.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"1950085a63b58dddf5cbedbbc2ab7a7d7d1a91e5"},{"fixed":"70e1d2b1b3850cc5b69de54cd255fc8c5a45809a"},{"introduced":"06d635e2672df934233b04c097afef29f62587da"},{"fixed":"82cca0679aa3d0e04a0f64e74d30f4ba79e0d416"},{"introduced":"51217c93c66345dd99c93605060f30ec8d1c36ee"},{"fixed":"41b9b4028ed205559c15778fa630eec6a15496d4"},{"introduced":"1c043970cac11a297f1c0744db90ba1421d582a5"},{"fixed":"909c4bf9b308cf9cab52bfed54adccd04bad5803"},{"fixed":"f9a677408ffb06f309be46ef9d8df1915d9099a4"}],"database_specific":{"extracted_events":[{"introduced":"11.6"},{"fixed":"11.10.13"},{"introduced":"12.0"},{"fixed":"12.6.7"},{"introduced":"12.7"},{"fixed":"12.10.2"},{"introduced":"12.10.3"},{"fixed":"13.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32620.json","vanir_signatures_modified":"2026-08-07T16:57:22Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java","function":"testValidationKeyStorage"},"deprecated":false,"digest":{"function_hash":"74993982675903380300558167265386334505","length":1635},"id":"CVE-2021-32620-60692a16"},{"deprecated":false,"digest":{"line_hashes":["166565996346234007952578434145113726337","34829311102813294821476151928182488625","249746745310220631589336637763246409542","26767898319983850590131920081022792543"],"threshold":0.9},"id":"CVE-2021-32620-cac56baf","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["333884364067774965770896065528305408985","237466027818441016518720692688188386773","231454723608874196696161139047446081652","54018045994974618111647359857516213772","202616622984379918360185746959868606406","189778971827438261842333342334267405657","38538732939526166594164616750257449880","62291361967030770090905944611693644655"]},"id":"CVE-2021-32620-e8ffd0b7","signature_type":"Line","signature_version":"v1"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"validateUser"},"deprecated":false,"digest":{"function_hash":"290506542892366268742433191790491887891","length":1246},"id":"CVE-2021-32620-ff6d5e03","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}