{"id":"CVE-2025-46554","summary":"XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API","details":"XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.","aliases":["GHSA-r5cr-xm48-97xp"],"modified":"2026-08-12T15:13:51.458674Z","published":"2025-04-30T18:27:53.677Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46554.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.8.1"},{"fixed":"14.10.22"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22424"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46554.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5cr-xm48-97xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46554"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"a75114d3e9875bc3383329fa44f9b47bf2871762"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"a74a28b426e394510b9cebcf261fc91853719acf"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"5d810c17daacfef0a76e0800354511dbdf871b5b"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"15.0"},{"fixed":"15.10.12"},{"introduced":"16.0.0"},{"fixed":"16.4.3"},{"introduced":"16.5.0"},{"fixed":"16.7.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"6914819340c6e94b51b7e5c68613f47831d4996b"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"82ba90784232fd5947c70b74bbbcfc67a245aca1"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"a1474519e8b8025cd704b608450b7622d3163681"},{"fixed":"37ecea84fdd053c33733c2ae9a0778bf98eae608"},{"fixed":"a43e933ddeda17dad1772396e1757998260e9342"},{"fixed":"c02ce7843a39851865b9d7b6132e32fdd21e3856"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"15.0"},{"fixed":"15.10.12"},{"introduced":"16.0.0"},{"fixed":"16.4.3"},{"introduced":"16.5.0"},{"fixed":"16.7.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46554.json","vanir_signatures_modified":"2026-08-12T15:13:51Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/attachments/AttachmentsResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["271222280416443639707668829031231752956","61178804486309906258473007893077723643","77150776739467516363537270204444228502","126032220484950708142107665585725028980","228363429857992000420625550875559748249","338379560377087766538870422344380427840","232588093424152413363187323460008413291","296198533569423769198696606162456576768","167161990792139934819487265237074797442"],"threshold":0.9},"id":"CVE-2025-46554-0efa21de","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608","target":{"file":"xwiki-component/xwiki-component-default/src/main/java/org/xwiki/component/annotation/ComponentAnnotationLoader.java"},"deprecated":false,"digest":{"line_hashes":["279996040616240033048317151141465971223","63480981983410327254449103487202754734","166055876944648832198567989294601159874","87656207174105165386304959920291028867","45416947498930657728133433363743110947","159998568406179035743791290832946874559","132762063020150089644316896472829724597"],"threshold":0.9},"id":"CVE-2025-46554-22161cf3"},{"id":"CVE-2025-46554-3a790a3a","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608","target":{"file":"xwiki-component/xwiki-component-default/src/test/java/org/xwiki/component/annotation/ComponentAnnotationLoaderTest.java","function":"testOverrides"},"deprecated":false,"digest":{"length":413,"function_hash":"319696321991483902318616819146081450572"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/wikis/WikiAttachmentsResourceImplTest.java","function":"getAttachments"},"deprecated":false,"digest":{"function_hash":"216674627221306195116507210413665903076","length":1232},"id":"CVE-2025-46554-3ee11a32","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["128205215619784860505560691424437765780","271741216023154103002269632854600722104","162548602528504758531447331614570805836","197218026322200313575553415460660788626","186757299259157404853682316805834370471","165145067342537025086321957444537830464","123935610610063406442136485949390161547","117583145691801919306651511256326376829","183679129417912594594289276401743356521","86041180853477372696256875334665686140","235297795083225495673665298306177905584","24347539411103939997957456250745781424","308423107115460905053613977459743676507","164389528709554626293076615703270602763","168248489421915805594496202166096023906","89317866248956902800168880311614021665","56157148839807800314732327216694542406","330175521504403839845732642149455164141","167488609235483604821015000173629729209","107959762650684564353131625456110941097","134024940835162562703822610118800631776","91427761260587130281466413620584076574","27618400638679057293159673082362615391","188019433314750527482210697050165663285","322586979025409756350145840017184253073"],"threshold":0.9},"id":"CVE-2025-46554-74fa4440","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/wikis/WikiAttachmentsResourceImplTest.java"},"deprecated":false},{"digest":{"function_hash":"183578898659158258578296343237849803053","length":1306},"id":"CVE-2025-46554-7f2bc2e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608","target":{"file":"xwiki-component/xwiki-component-default/src/main/java/org/xwiki/component/annotation/ComponentAnnotationLoader.java","function":"initialize"},"deprecated":false},{"digest":{"line_hashes":["275794024517038829705789551347538059566","175876832033980944337461512203939835640","168004375500754996568073926983319223599","45781406895496274663423848633208041154","139176414676959590359021428953305333808","142084367809119525753970024321086975390","51898526852151804988048547982650094763","267697658058996804131701297376161218570","146897789261645302920839404294163792055","287207050997830097556134094090086869865","203451007883144443479166785981936973049","251576806825770229586745831254931416924","201664644220110125726952835219317589209","158214382401177012207219268387428845708","236125877835400970788422979525739693335","286242273149649746956285818653493748434","170681510944300520959309914191857287727","199820853727308801520342061160398569180","148855176950170097471560583165298352149","88752396961543268032848084009909827939","214044021845286392479172932505778297847","320515353316990079236365405002964617993","159606592319555721181921845752561337075"],"threshold":0.9},"id":"CVE-2025-46554-81e9c9a0","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608","target":{"file":"xwiki-component/xwiki-component-default/src/test/java/org/xwiki/component/annotation/ComponentAnnotationLoaderTest.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/spaces/SpaceAttachmentsResourceImplTest.java"},"deprecated":false,"digest":{"line_hashes":["116785895770272363928071737321160661658","271741216023154103002269632854600722104","162548602528504758531447331614570805836","197218026322200313575553415460660788626","186757299259157404853682316805834370471","165145067342537025086321957444537830464","123935610610063406442136485949390161547","117583145691801919306651511256326376829","183679129417912594594289276401743356521","86041180853477372696256875334665686140","235297795083225495673665298306177905584","36861737178475016763398171648701409445","14628639534752756430778083138393654183","210367419178954808314354720393312789928","260330886042332156134433345863130992892","126049538792345203962136733648017090769","88192353346399270015931216033999983609","175283553048098470200867529228441699568","126059191966402654375872407916916100009","59930521351203858355793940826436480830","17748756091443201396991792812319305381","323586411114149347460003516809979524151"],"threshold":0.9},"id":"CVE-2025-46554-89a84f6f","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"57958456193298884536574957882212212435","length":2785},"id":"CVE-2025-46554-956b15a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/attachments/AttachmentsResourceImplTest.java","function":"getAttachments"}},{"digest":{"function_hash":"110873381031474286360359495154164791765","length":775},"id":"CVE-2025-46554-b09c3f7e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseAttachmentsResource.java","function":"getAttachments"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/spaces/SpaceAttachmentsResourceImplTest.java","function":"getAttachments"},"deprecated":false,"digest":{"function_hash":"307567537950774499836495885326742471697","length":1581},"id":"CVE-2025-46554-b5b5895b"},{"deprecated":false,"digest":{"line_hashes":["195184728712371664461645896299954920934","26790394271792461371986976206492149396","81526336630242233591524187673745370189","306963085561788174236384641322453170381","141067982956242643007466272494666179699","37660634045536912599245183053089090136","118715208415318792984432893466692198380","116480386319490006484222441472471438539","170592176290067629884345420543075793289","76631614782281521438011941569101017390","320584110042960148567637894564380108103","233986837467776479199271190850894506883","77381718531202508064439099257348711420","139300747868159909113862462798843602297","179770613839328921308421448627958168354"],"threshold":0.9},"id":"CVE-2025-46554-c97fa019","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseAttachmentsResource.java"}},{"digest":{"line_hashes":["36425152367187051709974525168248298187","185419423785149483892030680589266430487","81908068330526711045808743465451289466","35725773776387057498809422790005460197","310399331766624307343648324191142742607","198479907770745784675725998248917924887","118168330383144229069337538005396547076","126032220484950708142107665585725028980","233716586249115245792409958528619977047","21058331190837545321246285367596331724","163418652674431847886761772411800306323","88066193804674087426674459866253137320","287350637249987823307621672093881178542"],"threshold":0.9},"id":"CVE-2025-46554-d5a1fde9","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/attachments/AttachmentResourceImpl.java"},"deprecated":false},{"digest":{"line_hashes":["46509132122533989748297202936830653369","18452432426670668392516702883929473406","220042716535807628812056779947794159590","202424379988976590044393222337636381705","192604175022975940290033964590013258085","237166684711007054117645033364324452283","262005687037975851033151544393172976295"],"threshold":0.9},"id":"CVE-2025-46554-ebb4ca17","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/attachments/AttachmentsResourceImplTest.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}