{"id":"CVE-2022-36090","summary":"org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users","details":"XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This means a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default, so an inactive user could perform actions for such extensions. This issue has existed since at least version 1.1 of XWiki for instance configured with the email activation required for new users. Now it's more critical for versions 11.3-rc-1 and later since the maintainers provided the capability to disable user without deleting them and encouraged using that feature. XWiki 14.3-rc-1 and XWiki 13.10.5 contain a patch. There is no workaround for this other than upgrading XWiki.","aliases":["GHSA-jgc8-gvcx-9vfx"],"modified":"2026-08-12T13:33:04.552671Z","published":"2022-09-08T14:45:13Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36090.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19559"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36090.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgc8-gvcx-9vfx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36090"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"29774b2686839a6bffab208b26dfbbed1f23f481"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.1"},{"fixed":"13.10.5"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"e418311ea31a0bfb202414ef324369754eb9fe1f"},{"fixed":"5d629665e12a3ac3712ac96b2142e17dcd74e1dd"},{"fixed":"e074d226d9b2b96a0a1ba4349d1b73a802842986"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.1"},{"fixed":"13.10.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-13.10.4","xwiki-commons-13.10.3","xwiki-commons-13.10.2","xwiki-commons-13.10.1","xwiki-commons-13.10","xwiki-commons-13.10-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36090.json","vanir_signatures_modified":"2026-08-12T13:33:04Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"},"deprecated":false,"digest":{"line_hashes":["257908714711367016755236252804782708611","149886701224057808494458086497374506327","240095827261400842801005578641217302429","111081484626008364969209744751400838654","185708871354188851025735660441463714325","329787475554149753260334470227764064080","124781329453902936077905354530336277855","75171986607066271676685234492478171707","85814057365656175014623572892018772471","196673505963980381677774847838927220062","143232752268117118782679202112102916894","169683194663549633489764487131873280698","218655778520871095892192887755694285525","112072751446907866004645425649367182949","259609562801814463932570450232231756977","40036931920748626275341811709964225874","209558313872891782643261361801646352816","146430954691290754632077001437908117561","113440953746874428730669584103759139819","319721993175662937244517252286986584798","227247855036801765049450186322307867204","148559642534452674259990454975077849851","270568893320602111857674115814944690886","331892869606729476846737599386342594557","126726971814941014569801128861911878887","86002200788912750758635965901879857563","313570648336222106322890525507694696065","181129229262664073185558624660576076970","200069736107786648824749111920181885004","328831855932515246992528941162637644752","273705160358810255144983789042717498754","189650919264870142693334471698780177763","320438483162685253034254975503750176140","327022083284011070814734829154900887777","205521510208801835343992365017838912516","184810429439790457630717487057497087774","339787456559969915630747640728247183370","299718938009721369963249936487403821849","101438250763755147395286366954573803618","196728639220282212352021426722810409843","105681212428085862997019982193994125008","322975469373758052261070620334417561902","222167894719858284746632147400474189307","277039567602753716331644891463121903800","182722560769909470495229877677662484096","43968232614877061508219706289547750383","87742927220733847511114363975241854914","181625444597718800725156759740749014151","75407180318704451699303769443305508093","108587633537507210242609878158511307392","19478741279244872460101640644866316951","196388849704097562680926501727186780928","206940546758078681799959008591021210071","293105123317313194505816347180081180986","21914336334542394800342338273456193829","85775954192522451520422506203967244619","133385833784297376782623906363474206851","155714964565587438704010266430675614233","322174943287994127635152507760492762647","191871331035772864092889652358664651524","324109435435830837926499573843412359801","166742130510135254016246758987089439545"],"threshold":0.9},"id":"CVE-2022-36090-298a9314","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/XWikiCachingRightService.java"},"deprecated":false,"digest":{"line_hashes":["322776739252316916829046156976852701083","46715073007072620242667814725663631428","87602249713863932173416340421260251771","302454717900726377123643023908938687048"],"threshold":0.9},"id":"CVE-2022-36090-3d099928"},{"digest":{"line_hashes":["72827566320579380708885983900369040135","54368668103220078642918021003615502303","3801302872160828543784001321530124763","23185812299832241422803055678649018000","239980757302662077251821096004178254867","133312942913791466410734866455868768449","161601207322254442033333227670614241859","23826221342602061476898702144349511008"],"threshold":0.9},"id":"CVE-2022-36090-47ce80f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java"},"deprecated":false,"digest":{"line_hashes":["237128338465909122307249277413568001275","302402277244648242673020653383431870260","63532999756289606835926873937563354349","56404236446269723284715641529111731562","16251170017827662002721290837683684408","79193617345502535679718816501427343982","201463644475868288983173664642719343249"],"threshold":0.9},"id":"CVE-2022-36090-4cca84cc","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"prepareDocuments"},"deprecated":false,"digest":{"function_hash":"266764820714452949491668386685145685710","length":3958},"id":"CVE-2022-36090-6c1be0bc","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["102417900724480494051804295428205927454","82278014452114739896354276158904756995","97061292025246022301540998120119798376"],"threshold":0.9},"id":"CVE-2022-36090-716f9dab","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWikiContext.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-notifications/xwiki-platform-notifications-rest/src/main/java/org/xwiki/notifications/rest/internal/DefaultNotificationsResource.java","function":"getNotificationsRSS"},"deprecated":false,"digest":{"function_hash":"111919973054590063445673925687929505552","length":894},"id":"CVE-2022-36090-741d2c8d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"checkAuth"},"deprecated":false,"digest":{"length":99,"function_hash":"97994309014915887871739322870034392153"},"id":"CVE-2022-36090-99277a44","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"292035992371836667522014325379576531187","length":612},"id":"CVE-2022-36090-9d333f1b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"function":"checkAccess","file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/XWikiCachingRightService.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"checkAuth"},"deprecated":false,"digest":{"function_hash":"250166627173726354224438725163504288992","length":192},"id":"CVE-2022-36090-a45f0259","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java","function":"checkAuth"},"deprecated":false,"digest":{"function_hash":"82025841281352258358441902254272128493","length":128},"id":"CVE-2022-36090-e575c814","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"310713915497291484598724389852818570833","length":984},"id":"CVE-2022-36090-e5d67d6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"function":"getNotificationsCount","file":"xwiki-platform-core/xwiki-platform-notifications/xwiki-platform-notifications-rest/src/main/java/org/xwiki/notifications/rest/internal/DefaultNotificationsResource.java"}},{"digest":{"line_hashes":["13946751558791221646807318447097267737","122048640276596619032110205074027568920","108049801351475907788861119972446736830","224082117695036986753844404800970862688","301311188861644787942539551483339021217","249347933100832658893109065845757301217","126709273929608427282999253162440907424","246535379710884021410620387314316206396"],"threshold":0.9},"id":"CVE-2022-36090-e8413a0f","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986","target":{"file":"xwiki-platform-core/xwiki-platform-notifications/xwiki-platform-notifications-rest/src/main/java/org/xwiki/notifications/rest/internal/DefaultNotificationsResource.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}