{"id":"CVE-2025-29925","summary":"XWiki allows unregistered users to access private pages information through REST endpoint","details":"XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with \"Prevent unregistered user to view pages\": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.","aliases":["GHSA-22q5-9phm-744v"],"modified":"2026-08-12T14:52:34.214505Z","published":"2025-03-19T17:36:28.066Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-402"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29925.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22630"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22639"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29925.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29925"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"89fd7db3a1579cf5b76271f00774b0349a782d16"},{"fixed":"5a2b7a6776897660187239682caa6dc5467dd713"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"8c14d05055fc563d2838c2c9bb141e91d7401386"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"last_affected":"69d6e1ec9d9147f5dd6d5260bef78570d18e58bd"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.9"},{"fixed":"15.10.14"},{"introduced":"16.0.0"},{"fixed":"16.4.6"},{"introduced":"16.5.0"},{"last_affected":"16.10.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"a744864303bb132a55800f5846c51233830abab1"},{"fixed":"26b3bc4fcbf373467d4a70e7127a758dcc37c430"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"5292357f68df062a1b2f6a48410c3753e94771d3"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df"},{"fixed":"bca72f5ce971a31dba2a016d8dd8badda4475206"}],"database_specific":{"extracted_events":[{"introduced":"1.9"},{"fixed":"15.10.14"},{"introduced":"16.0.0"},{"fixed":"16.4.6"},{"introduced":"16.5.0"},{"last_affected":"16.10.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29925.json","vanir_signatures_modified":"2026-08-12T14:52:34Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206","target":{"function":"getPages","file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/wikis/WikiPagesResourceImpl.java"},"deprecated":false,"digest":{"function_hash":"64311348435243966757755016930476573864","length":2890},"id":"CVE-2025-29925-9f3c8e6e","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/wikis/WikiPagesResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["138549375513033347171623804982457570235","70038226735964741497518173792036116166","156182728382459651367634386820509449808","3775358027659907671919885106945314928","25364683297712809163374831299835604612","33023829289153245841221348457636566212","177779699407833604672352283748281317230","324043755918073607820256991894091218108","325591352857511821513179260995108954490","279321189022915217726989129797285657610","167060727297909357900851529283323898024","103266549912198392022407230839160413570","293249744413693438131946251074786208837","54549870806189391583764999982908103400","263478647662635162303716653708855371090","307559450968905362458213000128358185918","190206509270600805410246288542696869113","247795608246211973244323214950094319548","298145377215248422166197275138273827107","201250076132878601625737412587247350475","166900633162410745318912181870638072927","52317517904041560120143649278859838736","220336788550525974042909563675605881101","153573633185587297402953936888214175342","16065364730026839753756457000419947373","279981998301468004667250114677291861825","142121659439106328008811877225352946868","159736303404412023035108541823040620220","202232052877875883265662787535812502104","132680628970572153755659300662247225545","54439000496560275531324847576710945411","327472636990873942890846779414449516221","270767381785890644054342736219104341855","53746657345169581590196573875532461541","171751157592364337464737025613636320904","264929111237516790495588483224463986137","85610258641192726570090214757701622307","21411412756490803471426712893807485152","127019013591038711847920159585656505841","104425769447540581213319890243365749787","49365767676380782606007057787435842409","313265995893062256506610256153823810480","87667061478847161714016169056536777485","71817624476825156275475583746056808690","25514228701469280208334731640247609270","96450889907448135617223285327976548385","276787073013959177168346415651953195428","79255188978032416024989157140725567319","63903205278542990705870396237024170171","123212092088881229351241467317515923450","113519485916674162638541301274395896160","336505081153996091477894612734988000348","87743713581520543084939984132894148297","274763779621639484432542522643600384152","335871313205894390349967459652500975586","237974416474578520230610977542795898572","140690737425097890069425651161412433167","165947892600636435914183282630370239365","190150565545022397930411841096699957118","113235817900284902766656622053656485562","44259814072760552849698984126306493031","218254719476850738270782966122037265554","11809969507793336285784714789020374484","218482548752652933873704407133357273617","68888444401962736375737863459847188135","7005361021304112142403737493528209979","34890465642248467724758572712117777535","156234666723899638240491883573422839910","3824761359310122688705131241748969749","174211772268428694952246341209943039442","241258535973443679959403989587816931458","277272457969566279720734971750034682946","223081928972452396777278494386521738592","319720832804335705066899468862116100391","303828890539962469506983399220593935754","166955210251033722740460856330520469514","231336690152405853149469217323051010946","254670767356556492479095493499090850422","46096527227614140100588556169003097101","293132701773131525674621312515868559909","287283708725259801421913662001723000870","136977195691502005557464572481169288913","70450891745507078414257105606658975979","152196303631745846337244928514511987593","161206520692148108079447109275709826250","151060714194122843894506245182624333142","28082693690734393619413309089616032307","111815592282070624136136741629609759996","49571444992492886689617146445736191982","333088017141556884319358105224613879958","230810444416416295260822293168973921747","287828976752432874474946720404097422835","15215001067695801038856549839505821844","209485273953473932136722151709372717481","109894579197766863668520844349946877261","103752353330791920315325682227485817099","208116196741830523011126503923170454084","321454141386454262999228148072804276367"],"threshold":0.9},"id":"CVE-2025-29925-cfa6f5e6","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}