CVE-2022-31166

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, editing a right with the object editor leads to adding a supplementary empty value to groups which is then resolved as a reference to XWiki.WebHome page. Adding an XWikiGroup xobject to that page then transforms it to a group, any user put in that group would then obtain the privileges related to the edited right. Note that this security issue is normally mitigated by the fact that XWiki.WebHome (and XWiki space in general) should be protected by default for edit rights. The problem has been patched in XWiki 13.10.4 and 14.2RC1 to not consider anymore empty values in XWikiRights. It's possible to work around the problem by setting appropriate rights on XWiki.WebHome page to prevent users to edit it.

• CWE-269

• https://github.com/xwiki/xwiki-platform/pull/1800Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g4h6-qp44-wqvxThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-15776Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18386Exploit, Permissions Required, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/pull/1800Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g4h6-qp44-wqvxThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-15776Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18386Exploit, Permissions Required, Vendor Advisory

Published

Sep 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3116The Heimdal Software Kerberos 5 implementation is vulnerable…7.5
• CVE-2022-31160jQuery UI is a curated set of user interface interactions, e…6.1
• CVE-2022-31161Roxy-WI is a Web interface for managing HAProxy, Nginx and K…9.8
• CVE-2022-31162Slack Morphism is an async client library for Rust. Prior to…7.5
• CVE-2022-31163TZInfo is a Ruby library that provides access to time zone d…8.1
• CVE-2022-31164Tovy is a a staff management system for Roblox groups. A vul…7.5
• CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5
• CVE-2022-31168Zulip is an open source team chat tool. Due to an incorrect …8.8
• CVE-2022-31169Wasmtime is a standalone runtime for WebAssembly. There is a…7.5
• CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…