{"id":"CVE-2026-40104","summary":"XWiki's REST APIs can list all pages/spaces, leading to unavailability","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.","aliases":["GHSA-mrqg-xmgm-rc5g"],"modified":"2026-08-12T16:25:05.830525Z","published":"2026-04-15T00:01:58.583Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40104.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23550"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40104.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40104"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"10aac24eea2647c0e044176c369755baf8c5a5f1"},{"fixed":"f5d882bc97f326e1a4847aace42c60fe7cba0f41"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"fixed":"7ea92428b2dcec895366796ea6d211c01044257f"},{"introduced":"0f12307c8803e5abd5fe7016bd0adf0850c5f903"},{"fixed":"7b786a82160aed48172815cc1b7a66d46f7e5cc9"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8"},{"fixed":"16.10.16"},{"introduced":"17.0.0"},{"fixed":"17.4.8"},{"introduced":"17.5.0"},{"fixed":"17.10.1"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"943ce46958cb17adcf82e8fa381fb36616646f0b"},{"fixed":"12682112b51aa67f5acafa5398193b69adf229f7"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"617c215853ac7649119d019d085e739f5b2b89a8"},{"introduced":"b85d21efede0f7c07c04c5ad5fb7610be0866096"},{"fixed":"a44c0b52377470cd7b597f0e920cfbc85cf043e1"},{"fixed":"47b568c4753a6e682b14be1ca581bdd3b25d45a7"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8"},{"fixed":"16.10.16"},{"introduced":"17.0.0"},{"fixed":"17.4.8"},{"introduced":"17.5.0"},{"fixed":"17.10.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40104.json","vanir_signatures_modified":"2026-08-12T16:25:05Z","vanir_signatures":[{"digest":{"function_hash":"75574421566564608398195283329070200586","length":611},"id":"CVE-2026-40104-1e9146d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/DBListClass.java","function":"getDBList"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["234830944829192995068659288240396924635","88116946353640571016202014179835321140","318365460472491816240140358346962281073","103236191556676778339412799864892746707","10179317062567157067268899559870999302","269257390773631409230090461772295898722","219505462662310683705333797249573251268","84115996349633445266532442783838569619","151926094321760917351751180814074780955","39059257038073905944091613838753559715","61904159480560620376776107051782014053","226844519581446775197400784650115777246","76057362932050978659058979094723941765","282467605060331242761654288552248177680","209132401173306041901263793924701565686"],"threshold":0.9},"id":"CVE-2026-40104-964935ea","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/DBListClass.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/DBListClassTest.java"},"deprecated":false,"digest":{"line_hashes":["75688620387645609651633405990363477962","63770677638103208684810630145097366309","148552161452096559365260927369566208253","194044087889631132803148550671364721043","335841771938884455193177368197101640875","219109683626831899273207836399267546246","222417837104085862535184577132410512657","276841673132786708485735841426207163400","235747847600861037310319677598953157141","196505899681181821184436894622566590652","214997603798914742580358337858756830114","277075886222896385765576369016917731564","49762487272866010038173370699351162234","288940400948520525490791693468328449925","125089154310915617229547179193620234063"],"threshold":0.9},"id":"CVE-2026-40104-c87cdf9b"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}