{"id":"CVE-2023-26472","summary":"XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile","details":"XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.","aliases":["GHSA-vwr6-qp4q-2wj7"],"modified":"2026-08-12T13:34:03.215022Z","published":"2023-03-02T18:25:06.051Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26472.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-116"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19731"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26472.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26472"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"75947046d8ce1c942b6355740686f6673dc8aff8"},{"fixed":"bc18e50bcf9ea40d1e25ff8d065b3178c8247f16"},{"introduced":"491547c4f74b9be58123ef22081ae7e6840a11c7"},{"fixed":"61952343490e97926364658196c63936e0b384c5"},{"introduced":"bae1e23e73cafc007e5f28b39a04bfa0acf0199c"},{"fixed":"c2eb37f9cb37dab85f673e2151a323ff0074a365"},{"introduced":"e39d89e23a136223735afe358fa72f14cf6ff90a"},{"last_affected":"e39d89e23a136223735afe358fa72f14cf6ff90a"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.2:milestone1:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.2:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2.1"},{"fixed":"13.10.10"},{"introduced":"6.2-milestone1"},{"last_affected":"6.2-milestone1"},{"introduced":"14.0"},{"fixed":"14.4.6"},{"introduced":"14.5"},{"fixed":"14.9"},{"introduced":"6.2-milestone2"},{"last_affected":"6.2-milestone2"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"86fedf2c46d0514ea65038cdcea3f75e3a36aab5"},{"fixed":"61a67f5cf241df692779d77367168e0762119091"},{"introduced":"d971304b0e0bf4f6dad278de89518edc17459741"},{"fixed":"4db5104960c1c13a7d2b740800e2b9d0091444d8"},{"introduced":"ab4dfeaeef13360eebcaa507bc652073aa89a427"},{"fixed":"101becab4069ae9ccdc8c2f2c4edc562645e152b"},{"introduced":"3faaa3b41b298b5b1f3a03865bcbe8266c9fedd5"},{"fixed":"48caf7491595238af2b531026a614221d5d61f38"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.2:milestone1:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.2:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2.1"},{"fixed":"13.10.10"},{"introduced":"6.2-milestone1"},{"last_affected":"6.2-milestone1"},{"introduced":"14.0"},{"fixed":"14.4.6"},{"introduced":"14.5"},{"fixed":"14.9"},{"introduced":"6.2-milestone2"},{"last_affected":"6.2-milestone2"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["6.2-milestone2","xwiki-commons-6.2.2"],"database_specific":{"vanir_signatures_modified":"2026-08-12T13:34:03Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["241436754504398272115648114039472953574","91322937624014975635415446494396992257","32103860525410293523379766074701381496","251605682384583568173130527076895348872","176551276031469405012969301531465065399","249738932794603918895147802874559061868","237442739760926075942755818721344793633","130673880832601592644806389243963285305","325709585179185583938258691930285524337","232692643542311480839110895877709850802","271270627431092994921900384647716790093","147301953474738703334801375231293423059","163957069989654941094346220246830015359","263229491503953019806419193904670929484","68509759500716473715608746482911164635","254770110771673016696578075623870701522","221369428011411488614213454908029643030","129053359995965941106466394826931947357","198466006606398407417315422343812703261","15460976080312045789568412561963791854","272194200802180404642967107862461350221","45278952514421645158794402732721465786","225970964121589067238554686818687468426","306012811753088034862851382009846738112","237489778573347151907735532903319859318"],"threshold":0.9},"id":"CVE-2023-26472-3a4b15b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-test/xwiki-platform-icon-test-docker/src/test/it/org/xwiki/icon/test/ui/IconThemesSheetIT.java"}},{"digest":{"function_hash":"99005501258412968266234264224712886451","length":57},"id":"CVE-2023-26472-e14c9718","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-test/xwiki-platform-icon-test-docker/src/test/it/org/xwiki/icon/test/ui/IconThemesSheetIT.java","function":"setUp"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-test/xwiki-platform-icon-test-docker/src/test/it/org/xwiki/icon/test/ui/IconThemesSheetIT.java","function":"createIconTheme"},"deprecated":false,"digest":{"function_hash":"83324234962206109018852746895563801560","length":353},"id":"CVE-2023-26472-f4f9daf6","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26472.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}